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CHAPTER  1 


INTRODUCTION  AND  SUMMARY 

This  report  is  the  final  report  for  the  project,  "Vectored  Thrust 
Digital  Flight  Control  for  Crew  Escape",  contract  number  F33615-82-C-3402, 
sponsored  by  AFWAL/FIER.  It  represents  a  summation  of  the  work  performed 
under  contract  to  the  Air  Force  during  the  period  June  1982  to  February 
1985.  The  major  project  goal  was  to  investigate  the  feasibility  of 
designing  a  closed  loop  control  system  for  ejection  seats  utilizing 
vectored  thrust  propulsion  systems.  This  goal  was  achieved  most  affirmatively 
via  the  development  of  a  fast,  relatively  simple  and  relalble  control 
logic  which  is  particularly  suited  to  the  crew  escape  problem.  This 
central  activity  was  the  primary  item  in  Task  2  of  the  project. 

It  requires  much  more  than  developing  an  algorlthn  to  determine 
feasibility,  and  so  the  project  addressed  several  related  key  Issues, 
including:  (1)  developing  requirements  and  specifications,  and  synthesis  and 
analysis  simulation  capability  (Task  1);  (2)  control  component  hardware 
survey  and  trade  study  (Task  3);  and  (3)  prototype  simulation  on  a  real  time 
facility  of  the  control  logic  on  a  breadboard  controller  (Task  4).  For 
many  of  these  activities,  SSI  received  the  support  of  the  following 
subcontractors;  Stencel  Aero  Engineering  provided  ejection  seat  design 
experience  and  useful  insight  into  meaningful  analysis  methods;  Boeing 
Military  Airplane  Company  assisted  in  the  hardware  survey  and  provided 
engineering  support  in  the  use  of  their  EASIEST  software  package; 
Unidynamics/Phoenlx  designed  and  fabricated  the  wire-wrapped  controller; 
and,  Martin  Marietta  of  Orlando  provided  engineering  support  in  the  area  of 
propulsion  configurations,  as  well  as  supplying  personnel  and  facilities 
for  developing  the  real  time  hybrid  simulation. 

The  combination  of  declining  survival  statistics  during  crew  escape  in 
recent  years  and  Improving  control  component  technology  have  made  this 
control  design  study  timely  and  practical.  The  control  technique  is  based 
on  nonlinear  acceleration  control,  which  exploits  v  ry  well  the  unique  and 
highly  nonlinear  characteristics  of  the  pilot/seat  system.  This  report 


reviews  the  design  of  the  controller.  Including  the  related  actuator 
configuration  and  microprocessor  architecture  issues. 

A  bread  board  hybrid  simulation  utilizing  a  wire-wrapped  electronic 
digital  controller  and  a  unique  vectored  thrust  actuation  concept,  has  been 
developed  for  real  time  analysis  of  the  concept,  and  is  also  discussed  in 
this  report.  Examples  presented  show  that  this  design  represents  a 
reasonable  approach  for  the  control  of  the  seat  in  its  harsh,  highly 
constrained  environment,  over  several  diverse  escape  conditions.  The 
results  reported  here  are  derived  from  a  project  funded  by  the  Air  Force, 
AFWAL/FIER,  Wright- Patterson  AFB. 

We  wish  to  emphasize  here  that  this  project  is  a  feasibility  study, 
aimed  at  providing  conclusive  answers  as  to  whether  the  self-contained, 
vectored  thrust  crew  escape  control  concept  is  valid  when  used  with 
state-of-the-art  hardware.  The  scope  of  the  project  is  limited  primarily 
to  this  issue,  which  is  a  very  critical  and  important  one.  As  a 
consequence,  however,  there  are  other  important  issues  which  will  not  be 
fully  addressed  by  this  project,  or  in  this  report.  These  include  a  full 
design  to  incorporate  fault  tolerance,  redundancy  management,  hardware 
reliability,  and  many  hardware  component  design  and  implementation  aspects. 

This  report  consists  of  four  Volumes.  Volume  I,  containing  Chapters  1 
through  5,  reports  primarily  on  the  first  three  project  tasks.  Chapter  2 
introduces  the  basic  design  problem,  and  Chapter  3  presents  the  results  of 
the  Task  1  activity,  control  system  requirements  and  specifications 
analysis.  Chapter  4  presents  details  of  the  control  law  design,  as 
developed  under  project  Task  2,  and  Chapter  5  concludes  Volume  I  with  a 
discussion  of  the  control  system  hardware  identification  and  trade  study, 
the  primary  Task  3  activity. 

Volume  II,  containing  Chapters  6  through  8,  is  devoted  to  the  last 
project  task,  the  development  of  the  real  time  hybrid  simulation  system 
(Chapter  6),  simulation  results  (Chapter  7),  and  to  a  summary  of  the 
project  results  (chapter  8).  Volume  III  contains  Appendices  A  through  E, 
which  support  text  in  Volumes  I  and  II.  Appendix  A  presents  the  seat 


equations  of  motion  used  in  this  design  effort.  Appendix  B  shows  the 
blueline  drawings  of  conceptual  vectored  thrust  concepts  based  on  the  ACES 
II  prototype  seat.  Appendix  C  contains  a  listing  of  VAX-developed 
software,  and  Appendix  D  discusses  aspects  of  state  estimation.  Appendix  E 
describes  components  specifications  for  selected  control  hardware  elements 
which  have  potential  ejection  seat  application.  Finally,  Volume  IV 
consists  of  Appendix  F,  the  Martin  Marietta  hybrid  simulation  design 
report. 

The  authors  wish  to  acknowledge  the  invaluable  support  received  during 
the  course  of  this  project  by  many  fine  people  and  organizations.  In 
particular,  Steve  Baumgartner  of  Boeing,  Chet  Kylstra  of  Stencel,  Larry 
LaClair  and  Jerry  Roane  of  Unidynamics,  and  Keith  Klukis,  A1  Ciaponi,  Bill 
Hester  and  Les  Canney  of  Martin  Marietta;  at  SSI,  Dan  Martin  (who  authored 
Sections  5.3  and  5.4),  Raman  Mehra,  Kltkoon  Chan  and  Alina  Bernat. 


CHAPTER  2 


PRELIMINARY  DISCUSSION 


2.1  Statement  of  Problem. 

When  the  latest  generation  of  attack  and  fighter  aircraft  became 
operational,  the  Increases  in  performance,  maneuverability,  and  combat 
effectiveness  brought  with  them  a  disturbing  drop  in  both  combat  and 
non-combat  ejection  survival  rates.  The  Air  Force  has  in  the  past  few 
years  become  acutely  aware  of  this  trend,  and  is  initiating  a 
high-priority,  multifaceted  effort  aimed  at  developing  a  new  generation 
escape  system  whose  survival  envelope  is  capable  of  matching  the 
performance  envelopes  of  the  host  aircraft  to  a  much  greater  degree. 

The  object  of  the  current  project  reviewed  in  this  report  is  to 
provide  detailed  specifications  and  a  preliminary  engineering  design  for  a 
vectored  thrust  capable  "on-seat”  closed  loop  flight  control  system; 
further,  to  conduct  feasibility  and  hardware  trade  studies,  and  real  time 
breadboard  simulations.  As  such,  this  project  is  recognized  by  SSI  as 
playing  a  crucial  role  in  the  Air  Force’s  overall  effort  to  upgrade  crew 
escape  technology  and,  more  importantly,  save  the  lives  of  more  flight 
personnel. 

2.2  Overall  Approach  to  Control  Design. 

Our  overall  approach  to  the  TVC  design  involves  a  hierarchical  struc¬ 
ture  consisting  of:  (a)  Open  loop  acceleration  profiles  and  ejection  seat 
trajectories  obtained  using  cross-product  steering  or  a  trajectory  optimi¬ 
zation  algorithm  such  as  ESOP  (Section  4.2.4)  for  a  range  of  ejection  con¬ 
ditions,  and  implemented  on  line  in  a  closed  loop  mode  using  a  MAC-based 
acceleration  control  approach;  (b)  real-time  monitoring  of  the  ejection 
seat  dynamics  around  the  open  loop  trajectories  obtained  in  Step  (a),  and 
(c)  design  of  closed  loop  feedback  control  laws  using  the  acceleration 
control  approach  for  maintaining  stability  around  the  reference  traje« — 
tories  and  minimizing  the  effect  of  disturbances  on  overall  escape  system 
performance. 
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A  block  diagram  of  the  control  design  consisting  of  three  hierarchical 
levels  is  shown  in  Figure  2.1. 

The  reason  for  using  the  above  approach  is  that  the  Ejection  Seat 
Dynamics  is  highly  nonlinear,  whereas  both  the  LQR  and  the  MAC  approaches 
require  linear  models.  The  design  of  an  optimal  nonlinear  feedback  law 
requires  solution  to  a  dynamic  programming  problem,  which  cannot  be  solved 
except  for  systems  with  one  or  two  state  variables.  The  above  approach  is 
similar  in  spirit  to  that  of  Bryson  and  Ho  (19B9)  for  control  of  nonlinear 
dynamic  systems,  except  that  we  use  a  nonlinear  programming  approach  for 
trajectory  optimization.  The  reason  for  this  choice  is  that  it  is 
extremely  difficult  to  handle  state  inequality  constraints  such  as  the 
pilot  acceleration  limits  by  trajectory  optimization  techniques  based  on 
the  Calculus  of  Variations  or  Maximum  Principle.  The  nonlinear  programming 
approach,  especially  ESOP  described  in  section  4.2.4,  is  very  well  suited 
for  handling  large  numbers  of  constraints  on  both  the  state  and  the  control 
variables. 

2.3  Project  Organization. 

To  meet  the  major  objectives  of  the  design  effort  -  which  are  to 
design,  simulate  and  test  a  closed  loop  control  law  for  ejection  seats,  and 
to  assess  the  design's  feasibility  on  state-of-the-art  hardware  -  four 
tasks  have  been  defined.  These  tasks  will  be  outlined  in  this  section,  and 
they  include:  control  law  specification  development.  Task  1  (Section 
2.3.1);  control  logic  design.  Task  2  (Section  2.3.2);  control  hardware 
integration  and  trade  study.  Task  3  (section  2.3.3);  and,  prototype  design 
and  real  time  breadboard  simulation.  Task  4  (Section  2.3.4). 

The  project  team  assembled  to  accomplish  these  tasks  was  headed  by  SSI 
as  Prime  Contractor.  Subcontractors  were  Stencel  Aero  Engineering  and 
Boeing  Military  Airplane  Co.  for  Tasks  1  through  3,  and  Martin  Marietta  and 
Unidynamics/Phoenix  for  Task  4. 

2.3.1  Task  1:  Specification  Development.  The  primary  goal  of  Task  1 
was  to  develop  specifications  to  be  used  in  the  control  system  design 
phase.  This  goal  translates  into  one  of  finding  the  amount  of  control 


authority  required  of  the  on-seat  energy  sources  to  effect  safe  crew 
escape.  Within  the  scope  of  this  project,  safe  crew  escape  is  achieved 
when: 

(1)  The  escape  is  initiated  within  the  flight  envelope  specified 
by  MIL-S-9479B  (briefly,  from  0/0  conditions  to  altitudes  of 
50,000  feet  and  airspeeds  of  687  KEAS  -  knots  equivalent  air 
speed),  and  within  aircraft  translational  acceleration  limits 
specified  In  MIL-S-9479B. 

(2)  The  acceleration  environment  on  the  pilot  is  modified  or 
maintained  so  as  to  keep  the  acceleration  radical  from  exceeding 
the  value  1.0,  as  defined  in  paragraph  3.4.11.2  of  MIL-S-9479B. 

(3)  The  attitude  of  the  seat/pilot  combination  is  maintained 
within  the  range  of  orientations  and  rates  necessary  to  support 
item  (2)  above. 

(4)  Attitude  and  steering  control  is  such  that  the  escaping 
seat/pilot  avoids  any  aircraft  sections,  e.g.,  tail  or  wing,  and 
altitude  is  maximized  for  complete  and  safe  deployment  of  the 
main  chute. 

In  addition  to  the  primary  Task  1  goal,  other  critical  Task  1  activity 
involves  conducting  a  preliminary  sensor,  energy  source,  and  microprocessor 
hardware  survey  (Chapter  5). 

Our  analysis  of  the  control  problem,  conducted  during  Task  1,  has  led 
to  a  basic  control  design  approach.  This  approach  and  the  overall  control 
design  methodology  are  presented  in  Chapter  4.  The  control  design 
specifications  required  for  this  approach  are  also  detailed  in  Chapter  3. 

2.3.2  Task  2;  Control  Logic  Design.  As  stated  in  the  Task  2 
requirements,  the  goal  of  this  task  is  to  "prepare  the  final  optimal  design 
for  the  ejection  seat  vectored  thrust  digital  control  system".  Subsequent 
sections  of  this  report  will  document  that  the  control  approach  described 
here  has  been  implemented  and  demonstrated  successfully  in  the  harsh 


ejection  environment.  The  cases  presented  in  this  report  indicate  that 
this  implementation  represents  a  feasible  and  useful  design. 

The  design  accommodates  very  well  the  realities  of  its  operating 
environment.  Although  initially  tasked  by  the  Air  Force  to  perform  an  LQR 
design,  it  became  apparent  early  during  the  project  that  such  a  design  by 
itself  would  be  very  cumbersome  and  inefficient,  and  most  likely 
inadequate.  The  design  approach  which  evolved  is  based  on  sound  theory  and 
engineering  practice  and  is  unique  to  the  ejection  seat  environment.  It 
relies  on  techniques  of  nonlinear  trajectory  optimization  and  uses 
principles  of  Model  Algorithmic  Control  and  nonlinear  decoupling.  The 
final  control  approach  is  structurally  similar  to  an  acceleration  control 
concept  developed  by  Meyer  and  Cicolani  (1975). 

Chapter  4  will  present  the  details  of  the  control  design.  Briefly 
stated,  the  design  is  hierarchical  (see  Figure  2.1).  It  Includes  real-time 
access  to  reference  acceleration  trajectories.  The  latter  may  themselves 
be  computed  suboptimally  in  real  time,  or  the  controller  may  access 
prestored,  optimal  nonlinear  reference  trajectories.  This  is  the  outermost 
level.  Level  3.  The  reference  trajectories  are  supplied  to  two  parallel 
inner  loops  which  perform  angular  and  linear  acceleration  control  by 
comparing  predicted  accelerations  against  the  prestored  desired 
accelerations  and  processing  these  through  a  linear  filter  (Level  2).  A 
cluster  and  sensor  system  dynamics  are  incorporated  in  Level  1 ,  the 
innermost  loop. 

This  control  design  has  displayed  robustness  and  flexibility  when 
tested  at  extreme  design  point  conditions  such  as  low  altitude-high  dynamic 
pressure  and  inverted  attitude.  The  overall  control  law  is  nonlinear,  but 
includes  an  integral  term  to  eliminate  steady  state  errors.  It  generates 
commands  for  the  thrust  controller  which  is  assumed  to  provide  the  desired 
thrust. 

2.3.3  Task  3;  Hardware  integration;  Trade  Study.  The  purpose  of  this 
task,  which  is  reported  on  in  detail  in  Volume  1,  Chapter  5,  was  to 
determine  if  the  control  concept  proposed  is  compatible  with 
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"off-the-shelf"  control  hardware  components.  This  was  done  by  surveying 
current  hardware,  obtaining  key  performance  and  other  relevant 
specifications  (for  example  cost  and  weight),  and  by  developing  a 
quantifiable  measure  for  each  relevant  property,  with  a  view  towards  thrust 
vectored  ejection  seat  applications,  which  allows  a  trade-off  comparison  to 
be  made  among  equivalent  candidates. 

2.3.4  Task  4:  Prototype  Design;  Real  Time  Breadboard  Simulation. 


Although  the  control  design  effort  (Section  2.3.2)  is  central  to  the  entire 
entire  project.  Task  4  represents  the  culmination  of  that  design,  in  that 
its  performance  under  more  realistic  conditions  was  examined.  Inputs  from 
Task  3  allowed  for  a  refinement  of  the  Task  2  design,  and  the  final  design 
sequence  for  the  breadboard  simulator,  performed  in  Task  4,  exploited  the 
refinements. 

The  initial  scope  of  this  task  was  more  limited.  A  Tektronix 
microprocessor  development  lab  hosting  a  Motorola  MC68000  chip  was  obtained 
to  analyze  architecture  and  implementation  issues  for  the  real  time  version 
of  the  control  logic  (See  Volume  II,  Chapter  6).  However,  the  magnitude  of 
this  effort,  plus  limitations  in  equipment  and  microprocessor  development 
software  led  eventually  to  an  expansion  of  the  scope  of  this  task.  This 
was  because  the  Tektronix  system,  when  coupled  with  the  VAX  mainframe 
processor,  was  not  able  to  operate  in  real  time  on  control  logic  of 
reasonable  logical  complexity,  when  coded  in  a  higher  order  language. 

The  amended  activity  called  for  the  design  and  fabrication  of  a 
wire-wrapped  controller,  using  the  same  chip  and  higher  order  language 
(Pascal),  to  be  interfaced  with  a  hybrid  simulation  environment.  The 
VAX-Tektronix  system  was  then  to  perform  an  intermediary  role  in  developing 
and  debugging  the  controller  logic,  which  was  then  "burned"  onto  the 
controller  chip.  As  is  described  in  Chapter  6,  several  simulation  systems 
were  maintained,  each  with  varying  degrees  of  real  time  capability  and 
changeability,  resulting  in  a  flexible  breadboard  analysis  capability.  The 
overall  performance  results,  as  described  in  Volume  II,  Chapter  7,  were 
most  gratifying,  and  a  final  confirmation  of  the  practicality  of  the  control 
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CHAPTER  3 


TASK  I:  SPECIFICATION  DEVELOPMENT 


3.1  Introduction 

This  chapter  discusses  performance  specifications  and  quantifies  the 
plant  and  environment  models  for  the  ejection  seat  vectored  thrust  control 
design  effort.  Task  1  is  a  requirements  development  phase,  requiring  the 
development  of  quantified  specifications  on  which  the  ejection  seat  control 
system  is  to  be  designed. 

The  requirement  for  survivable  ejection  conditions  at  all  points  in 
the  "escape  envelope"  specified  by  MIL-S-9479B  (USAF)  Imposes  stringent 
performance  specifications  on  the  control  system.  The  control  requirements 
are  unique  for  the  seat/pilot  vehicle  in  that  crewperson  survivability  is 
the  primary  element  of  the  control  system  performance  index. 

The  ground  rules  under  which  the  control  system  specifications 
presented  here  apply  include  the  following.  Open  seats  as  typified  by  the 
ACES  11  model  built  for  the  Air  Force  by  Douglas  Aircraft  Corp. ,  in 
single-seat  aircraft,  are  the  focus  of  the  project  control  design  effort. 
The  control  system  design  is  to  be  fully  self-contained  on  the  seat,  and 
able  to  function  succesfully  without  dependence  on  the  aircraft  system 
avionics  or  other  external  data  sources.  The  hardware  utilized  in  the 
final  control  system  design  must,  as  completely  as  possible,  be  at  or  near 
state-of-the-art.  The  dynamic  environment  under  which  the  control  system 
is  developed  is  specified  by  the  digital  software  contained  in  the  SAFEST 
and  EASIEST  6  degrees  of  freedom  (DOF)  computer  programs  made  available  to 
SSI  by  the  Air  Force,  at  operating  conditions  established  in  M1L-S-9479B. 

It  is  expected  that  the  final  design  will  be  sufficiently  robust  so  as  to 
be  successfully  implemented  on  prototype  hardware. 

It  is  a  major  purpose  of  Task  1  to  identify  the  problem,  identify  key 
state  variables,  control  variables,  fixed  and  dynamic  constraints,  and 
appropriate  design  point  escape  conditions.  Another  critical  requirement 
of  Task  1 ,  Ln  the  context  of  the  design  methodology  presented  above  and 
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detailed  further  below,  is  to  quantify  the  thrust  capability  required  for 
various  worst  case  scenarios.  Results  of  our  analysis  in  this  area  are 
presented.  This  activity  as  well  as  the  activity  in  step  (2)  above 
represent  major  Task  1  results  needed  for  actual  control  system  design. 

The  robustness  of  the  control  design  is  to  be  assured  hy  use  of  a 
hierarchical  structure. 

The  control  approach  detailed  in  Chapter  4  places  importance  on  proper 
reflection  of  flight  conditions  to  be  used  in  the  design,  and  also  on 
having  a  reasonable  quantitative  understanding  of  the  ranges  of  values 
state  and  control  variables  may  assume.  Both  of  these  key  issues  are  dealt 
with  in  this  chapter. 

Section  3.2  will  discuss  basic  theory;  that  is,  equations  of  motion 
and  related  assumptions,  escape  conditions,  etc.  which  dictate  the 
operating  environment  for  the  control  system. 

Within  Section  3.3,  section  3.3.1  will  discuss  flight  conditions,  and 
list  those  which  at  this  time  are  considered  to  be  the  critical  design 
points,  as  well  as  cite  time  domain  requirements  for  these  flight 
conditions.  Section  3.3.2  will  list  all  of  the  constraints,  i.e.,  range  of 
acceptable  values,  for  the  state  and  control  variables  identified  for  each 
trajectory  phase.  Section  3.3.3  specifies  disturbance  modeling  and 
disturbance  rejection  requirements,  and  Section  3.3.4  places  some  control 
design  issues  in  the  context  of  the  crew  escape  problem. 

3.2  Basic  Theory 

This  section  sets  the  background  for  specification  development  and 
eventual  control  law  design.  This  consists  primarily  of  establishing  the 
operating  environment  for  the  seat,  and  specifying  its  mathematical 
description. 

3.2.1  Description  of  seat  dynamics.  In  this  section,  we  detail  some 
of  the  considerations  leading  to  development  of  the  seat/pilot  tions 
dynamical  system  which  is  to  be  used  in  the  derivation  of  the  closed  loop 


vectored  thrust  control  law.  Also,  the  main  sets  of  dynamic  equations  are 
presented  and  explained.  It  is  important  to  note  that  these  equations  will 
not  approach  the  detail  or  complexity  of  those  coded  in  SAFEST  and  EASIEST 
(see  Sections  2.4.1  and  2.4.2).  The  equations  represent  a  compromise 
between  a  high  level  of  accuracy  and  the  desire  for  both  a  tractable  level 
of  complexity  and  a  feasible  duty  cycle  time. 

Section  3. 2. 1.1  will  present  nonlinear  formulations  of  the  "free" 

(that  is,  fully  detached  from  the  rails,  plus  any  other  lines  or  tethers 
connecting  the  seat  to  the  aircraft)  seat/pilot  system,  acted  upon  by 
gravity,  aerodynamic,  and  (when  appropriate)  drogue  and  rocket  forces. 
Section  3. 2. 1.2  shows  how  the  propulsive  forces  and  torques  are  modeled, 
and  Section  3. 2. 1.3  presents  the  linearized  free  body  seat/pilot  system,  as 
well  as  the  second  order  spinal  compression  dynamics.  Finally,  Section 
3. 2. 1.4  describes  aspects  of  the  seat  dynamics  while  the  seat  is  moving  up 
the  rails. 

3. 2.1.1  Nonlinear  free  body  seat/pilot  equations.  We  now  present  and 
explain  the  nonlinear  set  of  dynamic  equations  to  be  used  in  the  free  body 
ejection  seat  TVC  control  law  design.  The  nonlinear  and  linear  sets  each 
have  a  use  in  the  overall  design  approach  (Sections  3.2  and  3.3).  The 
appropriate  set  will  be  used  as  part  of  the  constraint  equations  in  the 
optimal  control  formulation.  The  nonlinear  set  will  be  used  for  the 
off-line  optimizations,  and  the  linear  set  will  be  used  in  real  time 
applications.  Wherever  possible,  for  continuity,  we  have  retained  either 
explicit  SAFF.ST/EAS TEST ,  or  conven L  Loual  lerodynamic  naming  conventions. 

In  a  like  manner,  coordinatizations  will  follow  the  conventions  set  by 

s 

EASIEST.  To  assist  in  this  area,  we  make  the  following  definition:  v 

E 

represents  a  vector  quantity  associated  with  S  (seat,  or  seat/pilot 
together),  which  is  coord inat ized  in  the  R  (Earth-fixed)  frame.  The  E 
frame  is  considered  to  be  inertial  for  all  of  the  analysis  done  here. 

The  second  major  axis  system  is  that  attached  to  the  seat,  whose 
origin  is  at  the  Seat  Reference  Point  (SRP).  This  is  the  S  frame.  A 
related  frame  is  parallel  to  the  S  frame,  but  its  origin  is  located  at  the 
combined  seat/pilot  center  of  gravity  (CG).  Other  frames  will  be  defined 
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as  they  are  introduced.  All  frames  follow  the  usual  right-handed  geometry 
Sec  Figure  3.1  for  a  schematic  of  the  K  and  S  frame  relationship. 


For  the  purpose  of  development  of  appropriate  dynamic  relationships 
for  control  synthesis,  we  are  assuming  that  the  seat/pilot  mass,  moments  of 
inertia,  and  CG  location  are  fixed  in  the  S  frame,  once  a  given  escape 
trajectory  is  Initiated.  Any  time-dependent  changes  In  these  quantities 
over  the  course  of  a  trajectory  will  be  considered  as  disturbances  to  the 
control  system.  Fixed  disturbances  which  lead  to  changes  in  the  values  of 
these  quantities,  but  do  not  change  over  the  course  of  a  trajectory,  can  be 
modeled  directly  by  these  equations.  A  consequence  of  th*s  assumption  is 
the  representation  of  the  combined  seat/pilot  system  as  a  rigid  body, 
during  a  given  trajectory.  That  is,  seat/pilot  mass  and  moment  of  Inertia 
are  constant  during  a  trajectory. 

The  dynamic  equations  for  free  body  seat/pilot  motion  are  basically  an 
expansion  of  the  accelerating  frame  representation  of  Newton's  Law: 

mvS  a  _ni(,jS/E  ^  +  ma®*^  (3.1) 

lS(jS/E  3  _mS/E  (3.2) 

Here,  v®  Is  the  (inertial)  velocity  of  the  seat,  the  (inertial) 

angular  velocity  of  the  seat/pilot,  m  the  combined  seat/pilot  mass,  1^  the 
composite  seat/pilot  moment  of  inertia  with  respect  to  the  center  of 
gravity,  and  a®’'^  and  t®’'!  the  applied  acceleration  and  torque, 
respectively. 

The  applied  force  environment  includes  aerodynamic,  gravity,  all 
rocket  and  catapult,  and  drogue  forces.  For  the  time  being,  the 
development  presented  in  this  section  will  neglect  disturbance  effects 
modeled  as  noise,  in  addition  to  aero  forces  and  torques  generated  by 
stabilization  devices  such  as  fins.  Included  in  the  dynamic  model,  hut  not 
distinguished  symbolically  here,  is  the  mass-inertia  change  resulting  from 
drogue  deployment.  For  this  model,  the  drogue  will  be  assumed  to  deploy 
instantaneously,  and  the  mass-inertia  update  will  be  effected  at  drogue 


deployment  time.  Most  of  the  dynamic  analysis,  however,  occurs  during  the 
sustainer-on  phase,  with  no  drogue  chute  deployment. 

The  use  of  a  rotating  system  for  defining  the  basic  dynamics  in 
Equations  (3.1)  and  (3.2)  is  necessary  in  order  to  eliminate  severe 
algebraic  difficulties  associated  with  a  time  varying  inertia  tensor.  In 
addition,  it  is  most  convenient  to  represent  many  of  the  forces  in  the  S 
frame.  Equation  ^3,?)  must  be  applied  twice  in  order  to  isolate  position 
variables  such  as  altitude.  An  alternative  method  for  computing  position, 
which  we  follow  here,  is  to  transform  the  velocities  to  the  E  frame,  and 

then  directly  integrate  the  E  components.  The  Euler  angles  as  presented 

below  are  already  expressed  kinematically  in  a  directly  integrable  form. 

These  angles  are  assumed  to  be  in  the  yaw  (i|i),  pitch  (6),  roll  (41) 

sequence,  from  E  to  S. 

As  is  done  in  the  EASIEST/ SAFEST  code,  all  force  and  torque  components 
are  expressed  in  the  SRP-referenced  S  frame.  They  then  are  combined  into  a 
resultant  force  and  torque  before  being  converted  to  the  CG  frame.  The 
catapult  is  assumed  not  to  act  on  the  free  seat/pilot  vehicle.  Aero  forces 
and  torques  are  given  as  follows: 


fA  =  qS 


Cx(a,e,M) 

Cy(a,e,M) 


(3.3) 


Cz(a,S,M) 


tA  =  qsh® 


hD 

c„  +  rc„^  (_) 


(3.4) 


In  these  equations,  S  is  the  seat/piiot  reference  area,  q  the  dynamic 
pressure,  h^  the  hydraulic  diameter  of  the  seat/pilot,  p,  q,  r  the  roll, 
pitch  and  yaw  rates  of  the  seat/pilot  in  S  coordinates,  V  the  speed  in  the 
wind,  Cjip,  and  are  (constant)  input  aero  damping  coefficients,  and 

the  C  are  the  SRP-referenced  aerodynamic  coefficients,  which  are  modeled 
in  EASIEST/ SAFEST  as  tabular  functions  of  angle  of  attack  (a),  angle  of 
sideslip  (3),  and  Mach  number  (M).  We  use  bicubic  spline  representations 
to  model  the  Cj[  as  functions  of  a  and  3,  based  on  results  from  Beale  (1975) 
and  White  (1974).  This  model  neglects  direct  Mach-dependent  effects.  An 
analytic  representation  of  the  aero  coefficients  in  the  control  system 
model  would  greatly  ease  the  computational  butden  of  the  control  synthesis 
effort,  but  we  have  found  it  appropriate  to  evolve  indirect  schemes  for 
inferring  aerodynamic  forces  and  torques.  See  Chapter  4. 


As  stated  above,  the  drogue  is  assumed  to  deploy  Instantaneously  to  a 
steady  state,  line  stretch  condition.  If  we  further  assume  that,  in  this 
condition,  the  line  remains  taut  and  along  the  wind  axis  direction,  and 
further  assume  that  the  drogue's  Cp  is  constant,  then  the  force  and  torque 
on  the  seat/pilot  due  to  the  deployed  drogue  are; 


fD  =  -pDq  [CdS]D  v"  (3.5) 

fD  -  rD  X  f*^  (3.6) 


In  these  equations,  v'^  is  the  unit  vector  of  the  seat/pilot  with  respect  to 
the  wind,  Is  a  constant  drag  parameter  of  the  drogue,  and  Is  the 


bridle  attach  point  moment  arm 
ft  . 


Typical  values  for  [CpS]^  are  about  5.o2 


The  remaining  forces  are  due  to  gravity  and  the  propulsive  devices. 
Gravity  forces  are  expressed  in  the  usual  manner  in  the  S  frame  by  means  of 
the  Euler  angles;  the  expressions  for  the  propulsive  forces  and  torques 
are  derived  in  Section  3. 2. 1.2.  We  neglect  any  catapult-related 
interactions  on  the  free  seat/pilot  body.  Combining  all  of  the  above 
forces  and  moments  (and  converting  the  latter  to  a  CG  reference),  and 
expanding  the  expressions  in  Equations  (3.1)  and  (3.2)  results  in  the 
complete  nonlinear  set  of  equations.  (See  Appendix  A). 

3. 2. 1.2  Rocket  Force,  Torque  Equations.  The  arguments  of  f^  and  in 
Equation  (A.l)  represent  the  major  control  variables  for  the  seat/pilot 
system.  These  are  thrust  (T) ,  nozzle  pitch  angles  (0),  and  nozzle  roll 
angles  (<p).  These  are  depicted  as  vector  quantities,  with  Indices 
corresponding  to  a  given  nozzle.  Note  that  this  convention  departs 
somewhat  from  that  used  in  SAFEST/EASIEST.  The  YAW  and  PIT  quantities  in 
EASIEST  are  used  in  direction  cosines,  and  do  not  seem  to  be  as  physically 
meaningful  for  use  as  nozzle  gimbal  angles  as  the  ones  we  have  defined.  If 
each  rocket's  orientation  in  the  S  frame  is  specified  by  means  of  its  own  R 
frame  (see  Figure  3.2),  then  the  zero  nozzle  deflection  thrust  is  given  by: 


fR  =  _tzR 


(3.7) 


where  T  is  the  rocket  thrust  magnitude,  and  is  the  unit  vector  pointing 
in  the  direction  of  the  exhaust  plume,  along  the  nozzle's  axis  of  symmetry. 
The  unit  vector  zg  does  not  necessarily  point  along  the  fuel  cylinder  axis 
of  symmetry.  For  example,  the  ACES  II  sustainer  rocket  fits  in  the  seat 
back,  pitched  back  from  (-z®) ,  yet  the  nozzle  axis  points  forward  at  about 

A  A 

45  degrees  in  the  (-z®)-(x^)  quadrant,  to  go  through  the  50%-ile  pilot  CG. 
See  Figure  3.3. 

The  unit  vector  z*'  is  oriented  in  the  S  frame  by  the  angles  0g  and 
<(»g,a8  shown  in  Figure  3.2.  The  nozzle's  zero-deflection  orientation,  as 


well  as  the  resultant  nozzle  deflections,  are  best  defined  using  pitch  (9r) 
and  roll  (i^r)  angles. 


The  torque  on  the  seat/ pilot  due  to  each  rocket  is  given  by 

t-R  =  (rRN/S  +  (-rCG))xfR  (3.8) 

In  this  equation,  r^N/S  j^g  the  location  of  a  given  nozzle  with  respect  to 
the  SRP,  and  r*^^  is  the  CG  location  in  the  S  frame.  To  quantify,  for  ACES 
II  with  a  95  percentile  pilot,  the  EASIEST  value  for  the  CG  location  in  S 
(in  feet)  is 


rCG 


0.511 

0.0 

-0.790 


(3.9) 


For  nonzero  nozzle  deflections,  we  define  zRN  to  be  a  given  nozzle 

K 

principal  axis  unit  vector.  Its  general  orientation  in  the  appropriate  R 
frame  is  given  by 

(3.10) 

where,  for  example,  SQ  =  sin(9),  etc. 

For  convenience,  sub-  and  superscripts  have  been  omitted  here  from  the 
nozzle  deflection  angles  9  and  (ji.  The  general  rocket  force  and  torque 
expressions  in  the  S  frame  expand  to 


fR  =  (-T) 

s 


+  CaCoS 


'j>‘^9®4'R 


•c,j,S0SQ^  s^s^j^C9j^  +  c^ce^c^^ce 


(3.11) 


yRN^z  ~  (^Rir^CG^Ry 

(='RirzcG)Rx  -  (^rn-’^cg^Rz 

(xRN-xcG)Fy  -  yRN^x 


(3.12) 


Each  propulsive  device  modeled  on  the  seat  will  have  relations  of  the  above 
forms.  Note  that,  based  on  (3.9),  ycG  is  set  equal  to  0.0. 

The  linearized  versions  of  (3.11)  and  (3.12)  are  now  developed.  At 
this  time,  it  is  felt  that  the  linear  versions  will  be  appropriate  for  all 
control  synthesis  applications.  This  is  related  in  part  to  the  fact  that 
the  effective  nozzle  cone  angle  will  probably  not  exceed  20  degrees.  The 
cosine  projection  of  20  or  30  degrees  generates  about  a  k  7,  error  in  the 
linear  model,  and  the  sine  error  is  about  half  of  that. 


Define  the  linear  nozzle  deflection  angles  as  69  (pitch)  and  6^ 
(roll).  Because  these  are  "sufficiently"  small,  they  may  be  treated  as 
components  of  vector  quantities,  whereas  the  pure  Euler  angles  can  not. 
However,  we  retain  the  sign  conventions  of  the  Euler  set,  so  that  positive 
pitch  deflection  is  along  +Xs,  and  positive  roll  deflection  is  along  -ys. 
as  seen  in  the  linearized  version  of  Equation  (3.10) 


"JL\ 


Equation  (3.13)  orients  the  nozzle,  to  first  order,  with  respect  to  its 
zero  deflection  axis,  z^. 

SSI  Configuration.  At  this  point,  it  is  convenient  to  represent 
specific  conf igurations  of  nozzle  locations  for  seat/pilot  TVC.  Many  of 
the  following  assumptions  are  not  necessary.  The  configuration  presented 
below  is  best  taken  as  a  "generic"  one,  for  it  possesses  resultant  features 
of  many  likely  hardware  configurations.  The  goal  of  a  given  configuration 
is  to  provide  full,  decoupled  control  of  the  seat  attitude  and  displacement 
motion.  The  configuration  presented  in  Figure  3.4  can  achieve  this  goal  at 
least  mathematically,  when  control  of  thrust  magnitudes  is  introduced  along 
with  thrust  vectoring.  Controllability  studies  are  an  important  aid  in 
finalizing  the  configuration  (Section  3.2.2). 

The  configuration  presented  here  has  been  of  great  use  in 
demonstrating  feasibility  of  the  control  concept,  as  well  as  in  studying 
the  effect  of  actuation  dynamics  on  overall  system  performance.  However, 
this  configuration  is  not  practical  because  certain  commanded  nozzle 
deflections  and  rates  lead  to  thrust  impingement  on  parts  of  the  seat 
and/or  pilot.  An  alternate,  more  practical  configuration  is  discussed  in 
Section  3. 2. 2. 4.  This  configuration  uses  many  more  nozzles,  and  spreads 
them  out  over  the  seat  for  more  responsive,  efficient  energy  management. 


Figure  3.4  is  a  representation  of  three  gimballed  nozzles  directing 
the  (variable)  thrusts  of  three  separately  controlled  propulsive  devices. 
Number  2  may  be  thought  of  as  being  similar  to  the  current  ACES  II 
sustalner  rocket  in  location  and  thrust  capacity,  except  that  here,  we 
allow  nozzle  deflections.  Numbers  I  and  3  can  be  thought  of  as  vernier 
rockets,  with  perhaps  less  thrust  each  than  Number  2.  The  thrust 
modulation  and  vectored  thrust  features  of  Number  2  are  primarily  for 


steering  control;  however,  they  would  also  provide  a  certain  amount  of 
redundancy  in  attitude  control,  which  is  the  primary  activity  of  Numbers  1 
and  3.  It  is  not  important  at  this  time  to  specify  the  type  of  hardware 
used  to  vector  the  nozzles. 


The  key  to  Figure  3.4  is  the  symmetry  of  nozzle  placement  with  respect 
to  the  seat  x-z  plane: 


xi  =  X3 


A 

=x 


A 

y3  =  -Yi  =y 


y2  =  0 

A 

®Rl  =  ®R3  =®R 


A 

®R2 

Hi  =  <f'R2  =  'i'R3  =  0 


Tl 


T 


(3.14) 


Equations  (3.14)  were  used  under  the  following  considerations.  Nozzle  No. 

2  should  point  nominally  through  the  50%-ile  pilot's  seat/pilot  CG.  The 
geometry  for  this  is  seen  in  Figure  3.2.  If  r^G  is  taken  to  be  the  50%  CG, 
then,  the  nominal  zero  deflection  thrust  line  is  given  by 


rR  =  rN  -  rCG 


(3.15) 


where  rN  is  the  nozzle  location  with  respect  to  the  SRP.  The  unit  normal 

A 

of  rN  s  zR.  Equation  (3.10)  can  define  zR  if  we  replace  6  and  <t)  with  0g 

A 

and  (()^,  respectively.  If  we  then  equate  this  version  of  zR  with  the 
normalized  components  of  Equation  (3.15),  there  results 


-1  yN 

({)R  =  -  sin  ( _ ) 

dR 


(3.16) 
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where 


0p  =  sin 


(x^  - 

(xN  .  xCG)2  +  (zN  -  zCG)'2 


(3.17) 


=  (x^  -  x^^)2  +  (yN)2  +  (z^  - 


(3.18) 


If  Number  1  and  3  nozzles  have  primarily  an  altitude  control  role,  it 
may  not  he  necessary  to  require  them  to  have  a  zero  deflection  thrust  line 
through  the  50%-ile  CG.  This  is  because  these  nozzles  would  thrust  only  to 
cancel  disturbance  torques,  and  there  is  no  "nominal"  direction  associated 
with  this  activity.  This  is  why  all  of  the  in  (3.14)  were  set  to  0.0. 
This  condition  could  be  removed  of  course,  should  evolving  operational 
requirements  demand  it,  i.e.,  for  reliability  considerations.  These 
rockets  may  be  thought  of  as  RCS  clusters  of  nozzles,  with  each  nozzle 
fixed.  An  average  thrust  direction  over  time  could  be  generated  by  proper 
modulation  of  thrust  pulse  widths  in  the  appropriate  nozzles. 

Under  the  above  assumptions,  the  linearized  force  and  torque  equations 
for  the  entire  configuration  of  Figure  3.4  become 


fR  =  fRO  + 

S  S 


-Tcqr 

0 

-TZCSr 

0 

0 

0 

T 

0 

T2 

n 

Ts0r 

0 

T2S92 

0 

0 

(3.19) 


Lil 


Cftpo 


0 


0 


T(z-zcg) 


-T[(x-xcg)s0„  +  (z-zcg)C0r1  0  -T2[(z2-zCg)C02  +  (x2-xcg)s92^ 


T<x-Xcg) 


-T2(z2-Zcg) 


T2(x2-xcg) 


Ts0Ry 


TCe„y 


(3.20) 


#here 


f^O  =  (-T)  0  +  (-T2)  0 


(3.21) 


In  Equation  (3.20),  Numbej  2  has  been  located  in  the  x-z  axis  plane  of 
the  seat.  The  control  vector  u  arises  from  the  linearity  assumption  and 
the  particular  configuration: 


S  0  j  +  6  0  j 


+  6(j>3 


3. 2. 1.3  Linear  free  body  seat/pilot  equations.  Linearization  of  Equations 
(A.l)  is  an  exercise  which  must  be  done  with  care,  especially  in  the  case 
of  seat  dynamics,  because  the  seat/pilot  system  and  its  operating 
environment  is  highly  coupled  and  nonlinear.  In  addition,  the 
nonlinearities  are  not  only  in  the  nature  of  the  usual  complicated 
aerodynamics,  inertia  coupling,  variable  mass,  and  propulsive  effects, 
although  these  certainly  are  present  here.  Additional  nonlinearities  also 
arise  in  seat/pilot  dynamics  because  of  discontinuities  arising  from  such 
events  as  catapult  effects,  discontinuous  mass/inertia  changes  due  to  chute 
deployments,  line  stretch  effects,  and  the  rockets  turning  on  and  off.  It 
is  quite  obvious,  then,  that  the  various  assumptions  made  to  linearize  be 
clearly  noted,  and  the  limitations  which  arise  from  them  be  observed  as 
closely  as  possible. 

Linearization  is  assumed  to  occur  about  a  given  nonlinear  operating 
point.  It  is  consistent  within  the  expected  accuracies  of  the  seat/pilot 
linearization  process  to  assume,  for  the  ACES  II  prototype,  that 


^xy  “  ^yz  “0*0 


(3.23) 


This  assumption  is  not  strictly  necessary  for  producing  a  linear  system, 
but  it  greatly  reduces  algebra  and  eventually,  duty  cycle  requirements; 
also,  it  strengthens  more  standard  linear  assumptions  which  allow 
decoupling  of  variables  which  appear  as  products  in  the  nonlinear 
equations.  In  the  ACES  II  95  %-ile  case,  the  determinant  of  the  full 
inertia  tensor  for  the  seat/pilot  system  in  S  coordinates  is  2396.2 
slug-ft2,  and  its  value  under  the  assumption  (3.23)  is  2398.6  slug-ft^. 

The  operating  point  is  defined  as  generally  as  possible.  This  is  a 
reflection  of  the  typical  highly  coupled  attitude  motions  a  seat  is 
subjected  to  under  most  escape  conditions.  Thus,  all  state  variables  are 
redefined  as  follows: 


X  >  X  +  X 


(3.24) 
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The  left-side  variable  x  Is  computed  from  the  nonlinear  set  (A.l);  x 
represents  the  value  of  this  variable  at  the  operating  point  of  interest, 
and  the  right-side  variable  x  becomes  the  linear  state  variable.  Before 
presenting  the  equations,  we  note  the  following:  (i)  Linearization  is 
equivalent  to  generating  the  system  Jacobian  matrix.  This  is  done 
numerically  by  EASIEST;  the  analytic  Jacobian  derived  here  was  verified 
numerically  against  a  particular  EASIEST  computation,  with  good  results, 
(ii)  Some  nonlinear  variables  decouple  from  the  main  system  in  the  sense 
that  they  are  not  needed  to  define  the  dynamics  of  the  major  variables. 

The  variables  which  decouple  are  x,  y,  z,  and  4*.  Of  these,  x  and  y  are 
eliminated  from  the  system  totally.  Altitude  (  -z  )  and  heading  (  4»  )  are 
retained  because  of  more  relevant  interest.  Altitude,  or  its  estimated 
value,  is  an  important  variable  in  the  steering  loop,  (ill)  Angles  of 
attack  and  sideslip  are  defined  by  the  approximations 

o  =  w/V  6  =  v/V  (3.25) 

where  the  CG  speed  V  is  related  to  state  variables  via 

V2  =.  u2  +  v2  +  w2  (3.26) 

(iv)  Finally,  dynamic  pressure  was  assumed  to  be  constant  in  the  linear  set 
derived  here.  The  realities  of  high  Q  ejection  could  require  reassessing 
this  assumption  to  Include  first  order  dynamic  effects  while  keeping  air 
density  fixed.  The  linear  seat/pilot  system  is  also  shown  in  Appendix  A. 

We  now  present  the  equations  for  spinal  compression  of  the  crewperson 
during  ejection.  These  are  extracted  directly  from  MIL-S-9479B,  and  the 
EASIEST  software: 

2 

6  +  2a)nC6  +  tOnS  =  g^  (3.2 

where  z-axis  load  factor,  6  is  the  spinal  compression  in  Inches, 

and  the  natural  frequency  and  damping  of  this  system  have  the  values 


(Un  >  52.9  radlans/sec 

C  -  0.224  (3.28) 


The  dynamic  response  index,  DRI,  Is  related  to  6  by 
2 

“n^max 

=  -  -  86.9  6„ax  (3.29) 

g 

Equation  (3.29)  is  driven  by  the  z-axis  load  factor.  The  seat/pilot  load 
factors,  in  g's,  are  defined  with  respect  to  the  combined  CG  by  the 
following : 


■  -(-i-)[fext  _  (JS/E  X  rCG  -  uS/E  y  (o)S/E  x  r*^G)]s  (3.3i 

g 

In  this  equation  f®**^  represents  all  external  forces  applied  to  the 
seat/ pilot.  There  is  some  question  as  to  the  adequacy  of  referencing  the 
load  factors  to  the  combined  CG,  rather  than  to  a  more  vital  location,  such 
as  the  pilot's  head  or  a  particularly  sensitive  internal  organ.  However, 
for  this  activity,  we  shall  remain  within  the  scope  of  the  level  of 
accuracy  of  human  tolerance  modeling  as  presented  currently  in 
EASIEST/SAFEST. 


gx 

«y 


Another  consideration  entirely  appropriate  for  the  system  (A. 2)  is  the 
modeling  of  the  actual  nozzle  dynamics.  At  this  point,  a  first  order  lag 
model  seems  acceptable.  The  consequence  of  introducing  even  first  order 
dynamics  is  to  add  each  nozzle  deflection  angle  to  the  list  of  state 
variables: 

If  5c  ^8  the  commanded  nozzle  deflection,  then 


6  -  -a6  +  k6c 


(3.31) 


where  &  is  the  actual  nozzle  deflection  (state  variable),  and  a  is  the 
system  break  frequency,  or  Inverse  time  constant.  The  parameter  a  is 
largely  set  by  the  physical  slew  rate  of  candidate  nozzles,  and  is  a  key 
design  factor.  More  complicated  models  are  not  really  very  critical  to  the 
control  design  problem,  because  of  the  hierarchical  nature  of  the  design 
method  favored  here.  This  hierarchy  implies  that  actuator  or  valve 
dynamics  occur  fast  enough  to  be  dynamically  nearly  "invisible"  to  lower 
levels  in  the  hieiarchy;  and,  in  any  case,  first  order  models  are  adequate 
to  study  dynamic  interaction. 

3. 2. 1.4  Seat-on-rails  Dynamics.  This  section  covers  dynamics  of  a 
phase  of  the  escape  sequence  for  which  explicit  control  design  was  not 
done.  The  discussion  is  included  for  completeness.  A  modification  of  the 
control  approach  can  be  applied  during  this  phase,  which  also  is  concerned 
with  initialization,  self-test,  determining  condition,  and  start-up 
activities  for  the  main  controller  function. 

The  dynamics  of  the  seat/pilot  system  on  the  guide  rails  is  naturally 
determined  almost  completely  by  the  behavior  of  the  "host"  aircraft.  For 
the  requirements  of  the  control  synthesis  effort,  the  rails  will  be  assumed 
to  be  attached  rigidly  to  the  aircraft,  and  to  Impart  to  the  seat  only  a 
friction  force  as  it  slides  up  them,  in  addition  to  the  contact  forces 
which  constrain  much  of  the  seat's  motion  to  follow  that  of  the  aircraft. 
The  degrees  of  freedom  of  the  seat  on  the  rails  are  thus  restricted  to  the 
translational  degree  along  the  rails,  until  all  but  one  set  of  attach 
blocks  is  free  of  the  rails.  At  this  point,  there  is  also  a  degree  of 
freedom  in  pitch. 

There  are,  then,  at  most  two  state  variables  which  can  be  modulated  by 
the  seat  control  system  while  it  is  on  the  rails:  rail  position  and  pitch 
angle  with  respect  to  the  aircraft  reference.  The  only  meaningful  control 
during  this  phase  is  supplied  by  the  catapult  system.  The  magnitude  of 
catapult  thrust  could  be  controlled  between  minimum  and  maximum  values  as  a 
means  of  controlling  accleratlons  on  the  crewperson  over  the  range  of 
escape  conditions.  A  minimum  catapult  thrust,  a  value  which  would  vary 
with  escape  condition,  is  needed  to  ensure  clearing  the  vertical  stabilizer 


of  the  aircraft.  The  maximum  value  is  closely  related  both  to  the  DRI 
(dynamic  response  index)  limit  the  pilot  can  tolerate,  and  to  the  aircraft 
z-axls  acceleration  at  ejection.  Depending  on  these  factors,  then,  the 
maximum  attainable  catapult  thrust  will  likely  be  modulated. 

For  the  system  considered,  the  seat  is  assumed  to  have  two  degrees  of 
freedom,  translation  along  the  rails  and  a  pitch  angle  about  the  two  slider 
blocks.  The  left  and  right  slider  blocks  are  assumed  to  translate  along 
the  rails  equal  amounts.  The  possibility  that  the  blocks  may  bind  in  the 
rails  due  to  lateral  forces  on  the  seat  is  ignored  in  the  model. 

Explicit  consideration  of  the  forces  of  constraint,  i.e.,  the  forces 
on  the  slider  blocks  that  keep  them  in  the  rails,  is  avoided  by  using 
generalized  coordinates  and  the  Lagranglan  formulation  of  mechanics.  The 
equations  of  motion  that  result  are  second  order  in  two  variables,  or 
equivalently,  first  order  in  four  variables.  The  simplicity  is  useful  in 
any  attempt  to  obtain  purely  analytical  results  concerning  the  behavior  of 
the  seat  while  it  is  still  on  the  rails.  See  equation  development  details 
in  Appendix  A. 

3.2.2  Rocket  Nozzle  Configurations  and  Controllability. 

The  use  of  vectored  thrust  flight  control  logic  on  an  ejection  seat 
requires  significant  upscaling  in  the  propulsion  system.  Current  rocket 
actuation  devices  provide  a  fixed  thrust  level  (at  a  given  temperature)  at 
a  fixed  attitude.  Requirements  for  closed  loop  control  for  the  next 
generation  seat  lead  to  propulsion  systems  which  are  to  be  considerably 
more  flexible  and  responsive  than  current  systems.  A  key  factor  in 
designing  properly  the  configurations  of  such  a  system  is  in  determining 
whether  the  system  is  controllable.  We  now  ligress  a  bit  to  relate  this 
concept  to  the  current  design  effort. 

Loosely  speaking,  a  system  is  controllable  if  it  can  be  brought  from 
some  given  state  at  tQ,  say  xg,  to  another  state,  x| ,  within  a  finite  time 
(t^-tg).  More  exact  definitions  involve  other  concepts  such  as 
"reachability"  -  i.e.,  the  state  xj  must  be  reachable  using  an  admissable 
set  of  controls. 
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In  the  ejection  seat  problem,  attitude  and  trajectory  control  are 
Important.  If  this  control  is  to  be  obtained  strictly  via  vectored  thrust 
control,  ignoring  for  the  time  being  such  devices  as  the  drogue  chute, 
aerodynamic  surfaces,  momentum  wheels  (e.g.,  STAPAC) ,  etc.,  then  it  is  very 
important  to  establish  a  minimally  complex  nozzle  configuration  which  will 
provide  the  required  control  of  the  seat.  To  scope  this  problem  we  are 
seeking  a  vectored  thrust  system  which  can  be  packaged  on  an  escape  seat  - 
a  requirement  which  results  in  several  performance  limitations  -  and  which 
can  provide  three-axis  attitude  and  three-axis  translational  control  of  the 
combined  seat/pilot  system,  which  is  viewed  for  now  as  one  rigid  body. 

This  is  the  basic  6  DOF  control  requirement  and  the  major  design  issue  is 
to  develop  such  a  system  with  current  hardware  and  software  technology, 
which  will  provide  adequate  control  of  attitude  and  trajectory. 

This  section  addresses  vectored  thrust  control  for  longitudinal,  then 
the  complete  longitudinal/lateral  (6  DOF)  cases.  In  order  to  mechanize  a 
minimally  capable  6  DOF  conf iguratlon,  we  have  Initially  developed  a  design 
which  has  a  minimum  number  of  independent  nozzles,  three  for  full  6  DOF 
control.  Each  nozzle  is  assumed  to  be  able  to  supply  any  thrust 
orleutaclon  and  magnitude  (within  physical  limits)  independently  of  any 
other  nozzle/ thruster  system,  although  some  hardware  components  could 
conceivably  be  shared.  Also,  the  thrust  vectoring  mechanism  is  not  an 
issue  here. 

Ideally,  the  controller  will  be  "decoupled",  that  is,  one  control 
input  affects  one  output  variable  only.  This  goal  would  be  very  difficult 
to  accomplish  for  6  DOF  ejection  seat  control;  furthermore,  some  coupling 
is  very  natural  and  not  a  hindrance  to  control  design.  For  example,  the 
seat  can  be  commanded  to  an  attitude  which  is  not  only  "safe"  (in  terms  of 
biodynamic  factors)  but  also  orients  the  net  thrust  vector  appropriately 
for  the  specific  trajectory  requirement.  Thus,  attitude  control  Is  always 
important,  and  usually  dictates  or  couples  into,  trajectory,  or  steering, 
control.  In  short,  we  are  trying  to  achieve  independent  attitude  and 
trajectory  control,  while  recognizing  that  some  coupling  between  them  Is 
allowable  from  the  standpoint  of  controller  objectives,  and  most  likely 
necessary  from  a  mechanization  standpoint. 


More  realistic  designs  tend  to  have  many  more  nozzles,  and  each  nozzle 
is  dedicated  to  the  control  of  one  or  at  most  two  degrees  of  freedom. 
Typically,  pairs  of  nozzles  are  used  for  attitude  control  about  each  axis, 
and  translational  control  Is  provided  by  other  thrusters  of  larger  capa¬ 
city.  By  greatly  Increasing  the  number  of  nozzles,  each  nozzle  becomes 
mechanically  simpler,  and  greater  control  redundancy,  hence  reliability 
results.  Many  of  the  nozzles  can  thereby  be  fixed  in  attitude,  which 
further  enhances  reliability  as  well  as  simplicity.  We  have  examined  such 
a  configuration  also,  and  it  is  described  in  Section  3. 2. 2. 4. 

3. 2. 2. 1  3  DOF  controllability.  For  pure  longitudinal  control,  as  for 

more  complicated  systems,  we  start  with  the  simplest  system,  and  only 
reluctantly  add  more  complexity.  A  single  nozzle  is  thus  analyzed  first 
(Figure  3.5).  The  usual  nozzle  deflection  angle  limits  (slew  rate  limits 
are  also  very  important,  but  this  is  not  directly  a  controllability  issue) 
and  selectable  thrust  capability  provide  less  than  full  controllability  at 
best;  however,  a  configuration  will  be  considered  if  it  can  supply  suf¬ 
ficient  forces  and  torques  for  the  allowable  escape  conditions  (speed, 
attitude,  altitude). 

One  nozzle,  shown  in  Figure  3.5,  is  not  sufficient  for  3  DOF 
(longitudinal)  control,  even  when  thrust  magnitude  (T)  and  deflection  angle 
(6)  can  vary  independently.  By  proper  design,  this  nozzle  can  be  located 
so  that  its  cone  angle  will  produce  ranges  of  the  force  vector  coincident 
with  the  majority  of  desired  accelerations.  However,  the  simultaneous 
satisfaction  of  an  altitude  requirement  cannot,  in  general,  be  met. 


“  w  =  vertical  acceleration 

It  is  very  evident  that,  with  (T,6)  as  the  only  independent  controls, 
only  two  of  the  above  quantities  can  be  controlled  explicitly. 

My  =  -T  R  sin  6 

a^  =  T  cos( 0+6)/inass  (3.32) 

a^  =  -T  sin  (0+6) /mass 

Given  desired  values  of  these  quantities,  Myj^,  Syp*  ®zp»  Equation  (3.32) 
shows  that,  say,  u  =  (T,6)  can  be  selected  to  control  a  =(ax,a2).  (0  is  a 
fixed  parameter).  If  this  is  done,  M  would  be  fixed  also,  and  would  not, 
in  general,  be  appropriate  for  pitch  control.  Control  of  at  least  one  of 
the  dynamic  variables  must  be  sacrificed  with  this  configuration.  (This 
could  be  acceptable  if,  say,  0,  1^^^,  R,  and  6n,ax  were  selected  so  that 
there  were  an  j  a^  ^lin  adequate  for  high  Q  tail  clearance.  However,  this 
value  may  be  inadequate  for  a  0/0  or  other  low  altitude  adverse  attitude 
escape,  where  more  z-axis  capability  is  needed,  but  would  perhaps  conflict 
with  the  M  and  a  requirements.  Control  logic  could  weight  which  two 
variables  are  to  be  controlled  depending  on  conditions.  This  type  of 
approach  was  taken  for  the  configuration  discussed  in  Section  3. 2. 2. 4). 
Addition  of  a  second,  similar  nozzle  would  provide  adequate,  independent  3 
DOF  control  in  the  appropriate  location  (e.g.  point  B  of  Figure  3.5).  The 
above  analysis  suggests  that,  for  this  case,  a  minimum  requirement  (necessary 
condition)  is  that  the  number  of  control  variables  at  least  equal  the 
number  of  variables  to  be  controlled.  We  do  not  offer  a  formal  proof  of 
this  contention,  but  note  that  this  contention  is  not  true  of  dynamic 
systems  in  general.  In  the  discussion  of  6  DOF  control  which  follows, 
however,  we  will  show  by  means  of  an  example  that  this  is  not  also  a 
sufficient  condition. 

3. 2. 2. 2  6  DOF  Controllability.  In  the  last  subsection,  it  was  shown 

that  3  DOF  attitude  and  steering  control  was  not  possible  with  one 
independent  nozzle.  One  nozzle  is  thus  clearly  Inadequate  for  6  DOF 
control,  even  when  it  can  move  in  a  full,  3-D  cone  and  vary  thrust 


magnitude.  One  nozzle  in  6  DOF  applications  consists  of  three  basic 
controls: 

u  =  (60,<54>,  T) 

Based  on  the  above  discussions,  it  follows  that  a  nozzle  with  this  control 
capability  can  control  translation,  within  the  usual  thrust  magnitude  and 
cone  angle  limits.  If  devoted  to  this  activity,  it  will,  in  general,  also 
generate  a  non-zero  torque.  This  torque  may  or  may  not  oppose  attitude 
control  objectives,  but  it  cannot  be  changed  without  compromising  the 
steering  control  function. 

If  we  do  isolate  the  translational  (CG  position)  control  function, 
however,  one  nozzle  suffices;  nozzle  force,  f  =  -T  z^*^,  as  defined  in 
Equation  (3.10).  From  this  equation,  it  Is  evident  that  any  "reasonable"  f 
can  be  achieved  by  at  least  one  feasible  set  u  =  (69,6<j>,T).  Figure  3.2 
defines  the  basic  nozzle  geometry.  Nominal  or  zero-deflection  thrust  is 

A 

along  the  (-z)  axis.  For  ejection  seats,  this  axis  will  be  located  to  pass 
through,  or  close  to,  the  seat/pilot  00. 

The  above  is  a  case  in  which  m  =  3  control  variables  "fully"  control  n 
=  3  output  variables'  ^y»  should  not  be  necessary  to  use 

equations  here  to  argue  convincingly  that,  at  any  given  orientation,  the  2 
orthogonal  axes  lying  in  the  pt hiui  perpendicular  to  the  thrust  axis  can  be 
controlled  via  thrust  vectoring,  but  not  the  thrust  axis  itself.  Thus,  if 
the  thrust  axis  is  called  the  roll  axis,  then  only  pitch  and  yaw  attitude 
control  is  possible  with  any  one  nozzle. 

It  is  therefore  only  one  simple  step  further  to  conclude  that  two 
nozzles,  each  with  3  independent  controls  (6  total)  cannot  fully  control 
the  seat/pilot  six  degrees  of  freedom.  Any  fi'n;  of  these  quantities  can  be 
controlled  using  a  two  nozzle  configuration  (due  to  dynamic  coupling). 
Partial  control  is  possible,  but  may  come  at  the  expense  of  unacceptable 
operational  compromises.  We  have  confirmed  this  result  numerically.  A 


'output  variables  are  often  a  subset  of  the  state  variables,  but  more 
generally,  they  are  functions  of  the  state  variables. 


A  * 

control  matrix  B  =  3(x)/3u  for  the  two  nozzle  configuration  has  been  set 
up,  using  n  °  m  =  6*  B  was  shown  to  have  rank  3. 

Analytically,  it  is  easier  to  look  at  submatrices  of  B  to  justify  the 
above  conclusions.  Consider 


(3.33) 

where  uj  =  (60, 6^, T)  for  nozzle  1,  etc.,  and  each  of  the  4  submatrices  of  B 
are  3x3  in  size.  Equation  (3.33)  represents  the  linearization  of  the  force 
torque  equations  about  some  nominal  dynamic  condition;  in  this  case,  u| 
and  U2  represent  changes  from  the  (nominal)  control  settings  Uj  and  U2. 

B^^  and  8^2  very  similar  in  form;  one  merely  refers  to  nozzle  I 
and  the  other  to  nozzle  2.  The  only  difference  lies  in  the  parameter 
values  which  locate  the  nozzles.  Thus,  if  Bj [  is  rank-deficient,  so  would 
be  B|2«  The  same  reasoning  applies  to  the  bottom  half  of  B,  [821822]*  Blj 
(where  J  =  1,2)  has  the  form: 

'-h  I  Tj  .9j  .♦j  I  ■ 

0  I  Tj  c^j  I 

Tj  I  Tj  I 

where  0j  and  <(ij  are  the  angles  which  orient  the  nominal  thrust  line  for 
nozzle  j  in  the  seat/pilot  body  axes,  and  c©^  =  cos(0j),  etc. 

Controllability  implies  here  invertibllity  of  B^j .  If  Bn  is  non- 
singular,  than  a  unique  control  set  Uj  can  be  found  for  a  given  vector  &f. 
This  can  be  considered  a  sufficiency  condition,  but  not  a  necessary  con¬ 
dition.  Thus  if  det  (Bij)  *  0,  our  assertion  that  one  nozzle  fully 
controls  3  axis  translation  is  valid.  The  determinant  computes  easier  if 
Tj  is  set  =  1.0,  which  can  be  done  without  loss  of  generality.  Then 
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2  2  2  2 
det(Bij)  =  c^j  [C9j  c^j  +  sej  ]  -  s^j  [-C0jS^j  -89^ 

=  1.0 

For  a  situation  in  which  the  2  nozzles  are  located  symmetrically  with 
respect  to  the  seat/pilot  x-z  plane. 


-ysejTj 

-(yc0jS^^+  zc^.)Tj 

(yC(|)jC9j-  zs^j) 

-(zC9j  +  xs9j)Tj 

(zSQjS^j  -  XC0jS^.)Tj 

-yc9j  Tj 

(xc<|,j+  ys0j  s^j)Tj 

(xs^j  -  yc,t,jS9j) 

where  x  and  z  are  fixed  moment  arms  to  the  seat/pilot  CG  from  the  nozzle 
and  y  is  i  depending  on  whether  nozzle  i  or  2  is  used  ( j  =  1  or  2) .  A 
little  more  algebra  shows  that 

det(B2j)  =  0.0  ,  j  =  l,2 

Thus,  for  a  representative  configuration,  the  general  conclusions 
concerning  6  DOF  controllability  using  2  nozzles  have  been  quantitatively 
demonstrated.  This  means  that,  even  though  there  are  m  =  6  free  controls, 
they  can  control  fully  only  5  of  the  6  output  dynamic  variables.  More 
control  capability,  i.e.  ,  at  least  one  more  nozzle,  is  required,  although 
the  levels  of  attitude  and  steering  achievable  with  the  pure  two-nozzle 
system  may  be  considered  to  be  marginally  adequate.  We  feel,  however, 
that  the  complexity  of  adding  extra  nozzles  is  more  than  offset  by  the  much 
greater  controllability  which  is  achieved.  Furthermore,  proper  design  and 
placement  of  a  three  or  four  nozzle  system  will  most  certainly  not  double 
the  size  or  weight  of  a  two  nozzle  system,  since,  for  example,  the  total 
system  energy  requirements  are  basically  fixed.  That  is,  four  2  thousand 
pound  nozzle  systems  can  provide  as  much  energy  as  one  8  thousand  pound 
rocket,  but  in  a  much  more  usable  form  for  control. 


conf ij^iirai. Ill!  is  proposed  from  a  control  designer's  point  of  view.  See 
Figure  3.4.  This  configuration  was  also  discussed  in  Section  3. 2. 1.2  in 
connection  with  development  of  the  rocket  force/ torque  equations.  In  terms 
of  packaging,  hardware  Inpliimentatlon,  etc.,  there  may  be  a  need  for 
modification.  Our  subsequent  analyses  show  that,  for  the  variety  of  escape 
conditions  and  the  demands  these  conditions  place  on  the  propulsion  system, 
the  minimum  three-nozzle  configuration  produces  impractical  thrust 
directions  in  many  cases.  That  is,  very  large  gimbal  angle  changes 
(leading  to  possibly  unrealizable  slew  rates)  and/or  exhaust  impingement  on 
the  pilot  or  seat  often  develops.  \  more  realistic  configuration  is 
discussed  in  the  next  section.  One  can  assume  that  either  RCS  values  or 
gimballed  nozzles  are  used.  The  key  concern  here  is  the  functional 
performance  of  this  configuration.  4  configuration  is  needed  which  is  able 
to  convert  the  force  and  torque  comnands  into  specific  nozzle  deflections 
andthrust  magnitudes.  The  functionally  easiest  way  to  do  this  is  to  locate 
two  nozzle  clusters  at  a  maximal  moment  arm  location  (e.g.  ,  off  the  pilot’s 
shoulders),  and  dedicate  these  exclusively  to  attitude  control.  These 
nozzles  would  be  symmetric  with  respect  to  the  seat/pilot  x-z  plane.  A 
third  nozzle  with  full  gimbal  and  scdtictable  thrust  capability,  located 
about  wheru  the  il  sustainer  rocket  is,  would  then  provide 

trajectory/ steer  lug  control. 

We  present  here  a  slight  modification  of  the  above  configuration. 
Again,  it  is  necessary  to  emphasize  that  this  is  a  functional  and  not  a 
hardware  configuration.  The  m')d  if  icat  io  \  r.^flects  the  fact  that  some 
coupling  should  exist  at  high  Q.  To  use  the  trajectory  thruster  only  for 
acceleration  control  would  effectively  "waste”  its  ability  to  aid  in 
offsetting  J;he  large  aero  pitch  torques  at  high  Q.  This  would 
unnecessarily  add  more  to  the  torque  thrusters'  energy  requirements. 

In  the  new  scheme,  the  2  symmetric  thrusters  would  provide  the  only 
lateral  control  function,  and  would  assist  the  central,  larger,  thruster 
with  its  functions,  if  they  had  any  reservi>  caii  ic.' ty.  The  central  thruster 
(No.  2  in  Figure  3.4)  would  have  only  longitudinal  control  capability. 

That  is,  U2  =  (02  »  ^2^*  Nozzle  2  can  be  positioned  so  that  it  cancels 


mosL  of  (.li.-  Q  a.  ro  i.or'ine  a.s  well  as  thrusts  In  the  standard,  desired 

direction  for  escape  (up  and  forward). 

For  the  ACES  tl  prototype,  nozzles  1  and  3  in  the  configuration  under 
consideration  need  a  combined  2000  pound  capability  and  nozzle  2  should  be 
si/.*.!  for  ibout  9000  pounds.  This  configuration  is  invertible:  that  is. 
we  can  solve  for  uj ,  U2  and  U3's  elements  by  using  the  force-moment 
equations  given  the  commanded  rocket  forces  and  torques  (fj,,  M^,) .  The 
equations  are: 


(Xj  +  X2  +  X3) 
(Yl  +  Y3) 

(Zj^  +  Z2  +  Z3) 


-z(Yi  +  Y3)  +  y  (Z3  -  Zj) 

z(Xi  +  X3  )  -  x(Zi  +  Z3)  +  Z2  X2  -  X2  Z2 

y(Xi  -  X3)  +  x(Yi  +  Y3) 


and,  for  nozzle  j, 


f(j)=  (Xj  ,  Yj,  Zj) 


in  seat/pilot  body  coordinators,  and  the  moment  arms  (e.g.,  x,  Z2)  are 
defined  in  Equation  (3.14).  The  car-e^lan  elements  of  f^-D  are  solved  for 
first,  and  then  readily  converted  to  the  "polar"  elements  ( 0j  ,  <()j  ,T  j ) . 

The  above  problem  is  overdetermined.  Thus,  we  define 


and  set 


=  W^^'c 


X3  =  k  Z, 
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This  reduces  the  inversion  problem  to  an  (analytic)  3-by-3  matrix  inverse, 
whose  singularity  is  related  only  to  nozzle  location  geometry. 


3. 2. 2. 4  A  Practical  Configuration. 

The  three- nozzle  configuration  discussed  in  previous  sections  is  ade¬ 
quate  for  the  preliminary  analyses  of  the  earlier  project  tasks,  but  a 
more  practical  design  is  needed  for  an  operational  seat.  Prom  the  stand¬ 
point  of  rapid  response  for  attitude  control  -  which  can  be  exceptionally 
critical  in  the  case  of  yaw  control  at  high  Q,  for  example  -  and  also 
simplicity,  it  is  better  to  have  more  fixed  thrusters  than  fewer  gi'ihalled 
thrusters.  Eventually,  weight  and  complexity  considerations  limit  the 
number  even  of  the  simpler,  fixed  thrusters. 

A  careful  design  which  can  exploit  redundancy,  packaging  and  weight 
requirements  in  an  efficient  manner  is  beyond  the  scope  of  this  proiect. 
Much  of  these  design  issues  havi-  Iwnn  addressed  by  a  parallel  Research  and 
Development  program.  Design  of  Selectable  Thrust  Propulsion  Systems  for 
Crew  Escape. 

In  addition  to  this  program,  our  own  analyses  led  to  the  conclusion 
that  dispersed  pairs  of  thrusters,  one  pair  for  each  of  the  three  rota~ 
tional  axes,  and  one  main  thruster  for  translational  contr<'l,  represent  a 
much  more  realistic  design  than  that  discussed  in  Section  3. 2. 2. 3.  Such  a 
configuration,  depicted  "generically”  in  Figure  3.11  (next  page)  consists 
minimally  of  seven  fixed  nozzles,  although  one  could  be  added  for  redun¬ 
dancy.  A  specific  design,  developed  by  Martin  Marietta  Orlando  Aerospace 
for  this  project,  was  mechanized  and  tested  successfully.  Table  3.0  shows 
the  definitions.  The  formulations  for  fr  (rocket  force)  and  tr  (rocket 
torque)  shown  in  the  Table  are  invertible  when  optimization  criteria  are 
applied  to  resolve  the  overdetermined  nature  of  the  problem  of  solving  the 
(fr,tr)  system,  which  has  six  equations  for  uc,  which  has  seven  variables. 
The  numerical  simulations,  which  were  run  on  the  same  problems  utilizing 
the  three-nozzle  configuration  of  Section  3. 2. 2. 3,  show  that  the  values  for 
the  uc  components  are  very  realistic,  and  within  specifications.  The 
thrust  levels  for  the  attitude  thrusters,  fl  to  f6,  are  in  the  0-2500 
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TABLE  3.0 


SEVEN-NOZZLE  ROCKET  CONFIGURATION 
FORCE-TORQUE  EQUATIONS 


fr 

tr 


-  f(oc) 


fltf2 

^3.^4 

^5t^6 

®7.^7 

cjfi  ♦  C2f2 

C3f3  -  C4f4 

•ifl  -  •2f2 

Ilfs  -  12*6 

■1*1  +  *2*2 

"1*3  “  "2*4 


pitch  pair 
yaw  pair 
roll  pair 
■aln  thruatar 


♦  asfs  84f4  ■¥  »yfj 

“  «5*5  “  C6*6 

-  Psfs  -  ajfg  -  cjfj 

♦  *7*7 
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pounds  force  range,  for  all  escape  cases  studied.  The  main  thruster  level, 
fly  ranged  between  3000  and  8500  pounds  force,  and  the  main  thruster  pitch 
gimbal  angle  remains  within  a  25  degree  cone. 

It  is  quite  evident  that  the  type  of  conf iguration  described  in  this 
subsection  is  representative  of  a  very  efficient  design,  from  a  control 
point  of  view.  See  also  Appendix  B. 


In  this  section,  we  will  discuss  the  control  system  design 
requirements.  Subsection  3.3.1  defines  flight  conditions  to  be  used  as  a 
baseline,  and  Section  3.2.2  presents  specifications  which  bound  allowable 
variations  in  the  state  and  control  variables.  Section  3.3.3  describes 
requirements  related  to  disturbances  in  the  dynamic  environment,  and 
Section  3.3.4  discusses  energy  requirements  for  crew  escape. 

3.3.1  Flight  Conditions  for  TVC  Design.  In  this  subsection,  we 
identify  what  shall  be  called  the  design  point  flight  conditions.  These 
are  defined  as  those  conditions  within  the  scope  of  the  requirement  of 
MIL-S-9479B  with  the  followng  features; 

(1)  A  minimum  set  of  flight  conditions  which  will  lead  to  a  corresponding 
set  of  parameters  for  generating  the  reference  accelerations.  Each  con¬ 
dition  is  to  have  a  set  of  gains  which  can  be  used  in  the  neighborhood  of 
that  condition.  The  robust  design  of  the  controller  permits  this  type  of 
use.  A  relatively  small  subset  of  pre-stored  parameters  would  then  be 
valid  over  the  entire  escape  envelope  (Figure  3.6). 

(2)  Each  flight  condition  itself  is  within  the  escape  envelope. 

(3)  Aircraft  altitude,  attitude,  airspeed  and  acceleration  are  the  major 
quantities  specifying  flight  condition.  Lesser  parameters  such  as  ambient 
temperature,  nature  of  terrain,  weather  (i.e.,  as  it  affects  visibility), 
etc.  are  not  considered. 

(4)  Each  flight  condition  selected  will  also  consist  of  added  aircraft 
acceleration  subconditions:  Gx  =  and  2g,  Gy  =  -2  and  +  2g ,  G^  =  -3  and 


+  lOg,  and  zero.  These  values  represent  extremes  derived  from  project 
requirements. 

Selection  of  flight  conditions  is  dictated  primarily  by  the  nature  of 
the  aerodynamics  and  rocket  or  catapult  accelerations  on  the  seat.  There 
is  no  doubt  from  the  literature,  and  our  EASIEST  experience  confirms  this, 
that  the  dynamic  pressure  (Q)  environment  imposes  severe  restrictions  on 
seat  attitude,  within  the  escape  envelope  of  Figure  3.6.  Energy  sources 
must  be  sized,  first,  to  deal  with  this  problem;  yet,  they  cannot  be  so 
excessive  in  terms  of  their  own  acceleration  capability,  needed  for  high  Q 
conditions,  that  the  radical  value  is  violated  at  lower  Q  conditions. 

These  considerations  are  quantified  below. 

The  reason  that  aero  and  thrust  accelerations  are  so  critical  is  that 
they  directly  influence  the  physiological  tolerance  limits  as  quantified  in 
the  acceleration  radical.  Flight  conditions  are  chosen  because  of  their 
"worst  case"  on  the  radical,  which  is  the  major  consideration  over  the 
entire  escape  envelope.  Escape  altitude  is  the  second  major  consideration. 
There  are  some  situations  for  which  optimizing  altitude  is  the  most  urgent 
requirement. 

Achieving  optimum  altitude  while  meeting  radical-imposed  acceleration 
limits  is  primarily  a  steering  problem.  The  various  adverse  altitude  con¬ 
ditions  specified  in  MIL-S-9479B  (cf.  paragraph  3.4.12)  are  each  tech¬ 
nically  an  escape  condition;  however,  a  steering  law  valid  at  -30  degrees 
pitch  angle  will  also  work  at  -60  degrees  in  pitch,  as  long  as  the  sensors 
are  working,  and  able  to  distinguish  attitude. 

These  considerations  have  led  us  to  select  three  major  crew  escape 
design  point  flight  conditions  for  the  Initial  control  design  phase: 

(1)  Low  altitude,  687  KEAS.  This  condition  emphasizes  in  the  extreme 
both  the  dynamic  pressure  and  altitude  constraints.  Our  numerical  studies 
(see  Section  3.3)  done  to  date  show  that  greater  thrust  capability  than  is 
currently  available  on  ACES  II  would  be  needed  by  a  similarly  configured 
seat.  Most  of  this  capacity  is  required  to  improve  the  radical  by  means  of 
offsetting  the  aerodynamic  decelerations,  but  capeity  beyond  this  is  a 


necessity,  because  steering  control  for  maxlinum  altitude  Is  so  critical  at 
this  condition.  Sufficient  capacity  to  clear  aircraft  extremities  at  these 
conditions  Is  required  also.  It  Is  felt  that  current  systems  have  this 
minimal  capability.  Three-axis  attitude  control  is  a  very  Important  control 
design  criterion,  since  accelerations  must  be  maintained  along  the  seat 
roll  axis.  This  condition  is  seen  as  the  major  challenge  for  concept 
feasibility.  In  Section  3.3  some  quantitative  requirements  are  presented. 

(2)  Low  altitude,  low  speed  (0/0).  As  stated  above,  the  capacity  of 
the  energy  sources  which  is  needed  for  condition  (I)  becomes  a  potential 
liability  at  this  condition,  because  the  capacity  tends  to  be  excessive 
when  not  counteracted  by  aerodynamic  forces.  Except  for  the  critical  need 
to  optimize  altitude,  this  condition  is  thus  a  wholly  different  one  from 
(1),  and  almost  certainly  the  control  motions  will  be  different.  Steering 
rather  than  attitude  control  per  se  is  the  predominant  control  design  con¬ 
sideration.  However,  sufficient  attitude  control  to  Implement  the  steering 
commands  is  required.  Excessive  capacity  in  the  energy  sources,  coupled 
with  aircraft  accelerations,  can  lead  to  DRI  excesses  here,  unless  there  is 
a  thrust  modulation  capability.  When  this  consideration  is  augmented  by 
adverse  attitude  steering  requirements  (e.g.,  roll  angle=180  degrees),  it 
is  evident  that  a  truly  effective  design  must  have  thrust  magnitude  control 
capability. 

(3)  High  altitude,  687  KEAS.  The  major  steering  problem  at  this 
condition  is  avoidance  of  aircraft  extremeties.  The  attitude  control 
requirements  are  otherwise  as  severe  as  those  of  condition  (1).  By 
definition,  the  areodynamic  forces  on  the  seat  are  similar  as  the  condition 
(1)  forces.  Another  difference  at  this  attitude  is  in  chute  deployment 
sequencing. 

The  remaining  seven  conditions  are  extracted  directly  from 
MTl.-S-947qB  (Table  3.1): 


TABLE  3.1  Low  Level  Escape  Performance 
(from  MIL-S-9479B)* 


Attitude 


Velocity 

(knots) 


Fore  and  aft  Roll  angle 


Altitude 

(feet) 


(4) 

Level 

60 

120 

0** 

(5) 

Level 

180 

150 

200 

(6) 

Level 

0 

150 

300*** 

(7) 

60 

down 

0 

200 

500 

(8) 

30 

down 

0 

450 

500 

(9) 

60 

down 

60 

200 

550 

(10) 

45 

down 

180 

250 

600 

*  Unless  otherwise  specified,  the  cited  conditions  are  at  the 
initiation  of  the  escape  sequence. 

**  Impact  occurs  at  instant  of  seat/aircraft  separation. 

***  10,000  feet  per  minute  sink  rate. 


Our  experience  with  the  basic  design  and  robustness  attributes  of  the 
contoller  indicates  strongly  that  parameter  selection  for  the  cases  above 
almost  certainly  will  suffice  when  a  "neighboring"  set  of  parameters  is 
applied  to  a  different  escape  condition.  We  were  able  to  exploit  this 
robustness  feature  to  great  success  during  Task  4  activities  of  the 
project,  relating  to  real  time  breadboard  simulations.  For  this  activity, 
twenty  new  cases  were  provided  by  the  Air  Force  for  demonstration  of  the 
controller  (Chapter  7). 

3.3.2  Minimum  and  Maximum  State  and  Control  Value  Specifications. 
This  subsection  reports  on  various  numerical  studies  conducted  in  support 
of  Task  1  activity.  The  ACES  II  seat  was  used  as  the  baseline  seat  model, 
and  also  for  the  most  part  a  95  percentile  pilot.  Some  studies  were  also 
done  with  a  5  percentile  pilot,  since  5%  high  Q  ejections  represent  the 
worst  case  load  factor  conditions. 


Relatively  simple  models  of  ACES  II  have  been  used  to  date  in  this 
effort  to  quantify  control  requirements*  The  accuracy  of  such  models  is 
felt  to  be  sufficient  for  this  purpose.  These  models  do  not  include 
components  such  as  STAPAC  (or  DART),  and  utilize  only  basic  functional 
descriptions  of  the  catapult,  rocket,  and  drogue  dynamics.  The  real 
concern  at  this  time  is  not  in  transient  behavior  or  higher  order  effects 
(although  the  actual  control  design  process  does  consider  these,  given  the 
nonlinear  nature  of  the  problem). 

The  major  question  dnlt  with  here  is:  How  much  thrust  control 
authority  is  required  to  stabilize  the  seat  and  at  the  same  time  maintain 
the  radical  constraint?  The  approach  has  been  to  consider  the  free  95% 
ACES  II  seat/pilot  in  an  airstream  at  various  attitudes.  The  seat  is 
subjected  to  aero  and/or  drogue  forces,  generated  by  EASIEST.  An  offline 
analysis  program  was  developed  to  compute  the  rocket  forces  and  moments 
required  at  each  initial  condition,  to  satisfy  the  radical  and  offset  the 
aero  and  drogue  torques. 

Aircraft  acceleration  f ield/maxlmum  catapult  acceleration.  The 


catapult  forces  act  primarily  to  effect  the  dynamic  response  index  (DRI)  of 
the  acceleation  radical ,  given  by 


Radical 


*  (4r)'  ^  {yf 


(3.34) 


DRI  is  the  dynamic  response  index,  a  measure  of  spinal  compression 
(MIL-S-8479B) .  The  limit  on  the  DRI,  DRIl,  is  never  more  than  IBg,  and  is 
more  commonly  16g.  In  Equation  (3.34)  Gx  and  Gy  are  load  factor  com¬ 
ponents.  Catapult  acceleration  can  reach  the  vicinity  of  12g,  but  this 
value  must  also  consider  the  aircraft  maximum  allowable  Z  acceleration,  as 
shown  below 


-3  <  Gz  <  10  g's 

Assuming  that  the  Radical  does  equal  1.0,  and  that  Gxj^=30,  Gy^=15,  and  that 
DRI  =16  (since  the  acceleration  vector  will  be  more  than  5  degrees  off  of 
the  seat/pilot  Z  axis),  then  DRIm3jj=  1 5 . 7 1 .  If  the  aircraft  has  G  =10g's, 
then  the  controll^ii  must  limit  the  additional  load  onto  the  man  from  the 
catapult  to  approximately  5.61  g’s.  Obviously,  the  best  approach  is  to 
have  the  controller  computing  the  Radical  as  the  ejection  is  occurring,  and 
if  it  appears  that  the  future  estimated  DRI  value  will  exceed  the  limit, 
the  controller  must  vent  the  catapult  or  otherwise  control  the  maximum 
acceleration  imposed  on  the  pilot.  On  the  other  hand,  the  time  to  catapult 
separation  increases.  Thus,  the  effect  of  aircraft  acceleration  In  the  X 
and  Y  directions  is  to  reduce  the  maximum  catapult  acceleration,  mainly 
because  the  DRIl  changes  from  18  to  16  as  the  acceleration  vector  shifts 
more  than  5  degrees  from  the  man’s  Z  axis.  The  further  reduction  in  DRI 
from  16  to  15.71  as  the  aircraft  X  and  Y  accelerations  go  from  zero  to  their 
limits  of  -A  and  ±2  g's,  is  less  than  the  standard  deviation  of  measurement 
of  DRI  (±1). 

Once  the  seat/pilot  is  free  of  the  aircraft,  only  the  forces  on  the 
seat/pilot  itself  are  important.  The  aero  forces  on  the  seat/pilot  are 
estimated  here  by  using  the  tables  of  aero  coefficients  contained  in  White 
(1974).  The  coefficients  for  a  15  degree  pitch,  and  a  Mach  No.  of  1.2, 
are  used  for  the  maximum  Q  cases.  Immediately  after  catapult  separation. 

For  the  maximum  drogue  deplo5niient  speed  case,  the  coefficients  are  for  0 
degree  pitch  and  0.9  Mach  No.,  seat/pilot  area  (S)  of  7  ft.  ,  and  a  total 
weight  (W)  of  415  lbs.,  are  used  as  constants.  This  gives  the  value  of 
"qS/W"=27  g’s,  which  is  close  to  the  G^  limit  of  30  g’s. 


A  simple  curve  fit  was  performed  on  the  force  coefficients,  resulting 
in  the  following  relationship  for  force  coefficients  as  a  function  of  yaw 


Cx  -  -1.0418  -  0.006355Y  +  0.000263Y 


Cy  -  +0.0140  -  0.0346121Y  +  0.000160Y  (3.36) 

Cx  =  -0.1480  +  0.001770Y  -  0.000026Y 

With  these  relations,  plus  the  values  Gx|^=30,  Gy^=15,  and  G^j^*  16, 
replacing  DRIj^  as  a  steady  state  approximation,  we  can  investigate  maximum 
allowable  yaw  angle  at  a  1600  Q  ejection,  first  without  rockets  or  drogue. 
(This  result  is  expanded  on  later  in  this  section.)  The  Radical  value  for 
zero  yaw  is  a  large  0.97.  The  yaw  angle  which  produces  a  Radical  value  of 
1.0  is  3.33  degrees.  Thus,  very  little  sideslip  can  be  tolerated  before 
the  rocket(s)  are  ignited. 

For  the  maximum  sideslip  at  emergence,  the  rocket  on  and  no  drogue 
case,  the  nominal  rocket(s)  assumed  here  have  a  -Z  thrust  of  3536  lbs.,  or 
8.52  g*8,  and  a  +X  thrust  of  3,000  lbs.,  or  7.23  g’s.  This  corresponds 
closely  to  the  current  ACES  II  and  the  Stencel  SIIIS  ejection  seats. 

Thrust  magnitude  is  about  4640  lb. 

With  the  forward  thrust  counteracting  the  frontal  aero  force,  and  the 
upward  thrust  counteracting  the  normally  negative  “lift"  of  the  seat/pilot, 
the  value  of  the  Radical  for  zero  yaw  drops  from  0.97  to  0.75.  The  yaw 
angle  which  causes  the  Radical  to  equal  1.0  above  increases  from  3.33  to 
10.7  degrees. 

Consider  now  the  problem  of  finding  the  maximum  size  drogue  at 
emergence,  with  rockets,  still  at  1600  Q.  If  the  drogue  is  immediately 
deployed,  we  are  interested  in  the  maximum  size  drogue  that  causes  the 
Radical  to  equal  1.0,  with  zero  yaw  and,  say,  17  degree  pitch. 

Solving  the  Radical  leads  to  an  additional  negative  G^  of  6.45  g's  and 
an  additional  upward  G^  of  1.97  g's  that  can  be  tolerated.  A  drogue  area 
times  drag  coefficient  (CpS)  of  1.75  ft.  would  add  these  accelerations  to 
the  seat.  Thus,  only  a  very  small  drogue  can  be  used  as  an  immediate 
drogue  at  maximum  Q,  which  is  not  practical.  Consider  now  the  speed  limit 
for  deployment  of  fixed  CpS  drogue  =  5  ft.  ,  with  rockets.  Assuming  that 
the  controller  pitches  the  seat/pilot  forward  to  zero  pitch  (in  order  to 


minimize  the  Radical)  and  obtains  a  zero  yaw  angle,  and  that  the  seat/pilot 
slows  to  approximately  0.9  Mach  No.  (to  use  the  0.9  aero  coefficients),  the 
maximum  speed  at  which  a  5  ft.  "CDS"  drogue  can  be  deployed  is  600  KEAS 
while  the  rocketCs)  are  still  thrusting. 

This  small  study  highlights  the  critical  requirement  for  the  TVC 
controller  to  maintain  attitude  of  the  seat/pilot  very  close  to  the  x-axis 
at  1600  Q.  In  addition,  the  role  of  the  catapult  and  sustainer  thrusters 
is  reducing  overall  load  factor  (hence,  the  radical),  by  offsetting  the 
aero  and  drogue  effects,  is  very  evident. 

This  study  was  expanded  upon  with  the  aid  of  EASIEST  runs  using  the 
ACES  II  free  seat/pilot  combination  at  1600  Q,  without  drogue  or  rockets. 

In  this  case,  only  the  aero  forces  are  computed.  This  was  done  for  one 
altitude,  at  several  incremental  values  of  yaw  and  pitch  angles  (to  the 
wind).  This  set  up  allows  for  simple  readjustment  of  forces  on  the  seat 
for  either  different  altitude  and/or  different  airspeed.  For  the  former, 
the  aero  forces  scale  by  air  density  ratios,  (P2/Pl)»  if  airspeed  is  fixed, 
and  changing  the  velocity  at  fixed  altitude  scales  the  aero  forces  and 
torques  by  (V2/V1)  . 

For  the  sake  of  sizing  the  thrust  requirements,  a  relatively  simple 
"static”  approach  was  used.  Where  the  load  factor,  given  by 

LF  =  -[fA  +  fD  +  fT]  /  wt  +  ((loxrf*^)  +  ( u)x( owr^^) )  -g]/GRAV  (3.37) 

(from  EASIEST  code),  exceeds  1.0  for  f^  =  0,  the  vector  is  given  a  value 
which  scales  LF  down  enough  for  the  radical  to  equal  1,0.  It  turns  out  that 
this  option  results  in  the  old  LF,  the  new  LF  ,  and  f^  lying  in  the  same 
direction.  This  is  actually  overly  restrictive  because  the  radical 
condition  (3.34)  plots  as  an  ellipsoid  in  load-factor  space,  and  LF  can  be 
at  any  point  on  or  within  this  ellipsoid,  not  necessarily  at  the 
penetration  point  of  LF,  to  satisfy  the  radical.  When  this  consideration 
is  combined  with  the  desire  to  utilize  f^  to  generate  corrective  torques  to 
the  aero  torques,  the  restrictiveness  of  the  algorithm  used  is  evident. 
However,  a  constrained  optimization  solution,  albeit  static,  is  required  to 


properly  posiLlon  and  size  Nevertheless,  some  very  useful  infor¬ 

mation  can  be  obtained  with  the  simpler  approach. 


In  addition  to  creating  a  "safe”  acceleration  environment,  it  is 
possible  to  locate  an  appropriate  moment  arm  for  this  f^,  which  will  offset 
the  aerodynamic  and  drogue  torques  as  well  as  generate  a  torque  to  correct 
the  seat/pilot  attitude,  as  follows: 

The  desired  torque  will  reorient  the  seat/pilot  x-axis  along  the  wind. 
The  x-axis  is  not  a  point  of  neutral  stability,  but  does  have  the  advantage 
of  being  the  minimum  radical  orientation  for  a  very  large  acceleration 
environment.  For  a  given  time  to  recovery,  DT  (we  have  chosen  0.05  and 
0.10  sec),  along  with  the  correction  rotation  angle,  the  initial  angular 
acceleration  can  be  computed,  which  leads  to  a  "desired"  restoring  torque, 
TC.  For  the  motion  with  respect  to  the  CG,  this  is  found  from 


1(0  +(ox((oxI)  =  Text  =  TA  +  TD  +  TT  +  TC  -  r^O  x  (fA  +  fD) 


(3.38) 


where 


current  aero  torque  on  seat/pilot,  about  SRP 
drogue  torque  on  seat/pilot,  about  SRP 
thrust  torque  generated  by  rockets,  about  CG 
commanded  (desired)  recovery  torque,  about  CG 
aerodynamic  force  on  seat/pilot 
drogue  force  on  seat/pilot 
seat/pilot  inertia  moment,  about  CG 


In  Equation  (3.38)  the  aero  and  drogue  torques  are  converted  to  a  CG 
reference  from  the  input  SRP-referenced  values.  This  is  not  an 
inconsequential  correction.  The  SRP-referenced  pitching  moment  coefficient 
at  1600  Q,  zero  angles  of  attack  and  sideslip,  is  0.104.  It  becomes  -0.150 
with  respect  to  the  CG.  Thus  a  pitch  torque  of  3415  foot-lb.  about  the 
SRP  becomes  -4947  foot-lb.  about  the  CG.  This  has  been  verified  by 
EASIEST  simulations. 

Table  3.2  summarizes  the  results  of  these  runs.  The  captions  are  for 
the  most  part  self  explanatory.  A  ”Y"  under  the  Drogue  heading  means  that 
a  steady  state  drogue  force  is  acting  on  the  seat/pilot,  along  the  wind 
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axis  line.  R  indicates  the  minimum  moment  arm  length  needed  with  the 
thrust  FT,  to  balance  the  aerodynamic  and  drogue  torques,  and  to  generate 
TC. 

We  have  used  a  "CDS"  factor  of  5.0  for  the  drogue,  so  that  its  force 
magnitude  at  687  KEAS  is  8000  pounds.  The  value  in  the  table  for  the 
Radical  is  the  "no  thrust"  value.  When  the  rocket  generates  a  thrust  of 
the  type  Indicated,  the  Radical  value  becomes  1.0,  for  all  cases.  Clearly 
there  are  several  cases  where  FT  could  be  oriented  better,  but  we  are  only 
using  the  Radical  =1.0  criterion  here.  In  one  case,  velocity  =  600  KEAS, 
with  no  drogue  force  or  aircraft  accelerations,  FT  need  only  be  1579  pounds 
to  satisfy  the  Radical,  yet  this  level  of  thrust  needs  a  moment  arm  of  2.39 
feet  to  correct  the  disturbance  torques.  Another  point  is  that,  when  one 
considers  only  satisfying  Radical  =  l.O,  other  problems  arise.  In  the  case 
under  discussion,  the  rocket  is  generating  only  350  pounds  along  the  z- 
axis,  and  this  is  inadequate  for  tail  clearance  at  600  KEAS. 

These  ACES  II  runs,  mostly  at  687  KEAS,  support  the  observation  made 
earlier  that  drogue  deployment  must  be  delayed  until  about  600  KEAS,  and 
that  yaw  angle  effects  at  high  Q  are  very  critical.  Also,  thrust 
capability  of  the  order  of  9000  pounds  is  needed  just  to  satisfy  the 
Radical  at  687  KEAS,  when  the  aircraft  is  at  all  of  its  acceleration 
limits.  Although  this  value  will  be  revised  downward  by  using  optimum 
design,  there  is  little  question  that  greater  thrust  capability  will  be 
needed  at  high  Q  for  safe  crew  escape.  This  analysis  indicates  that  a  net 
thrust  capability  of  up  to  12,000  pounds  for  the  ACES  II  is  likely. 

Finally,  Table  3.3  presents  the  state  and  control  constraint 
formulations  to  be  used  in  the  optimal  control  synthesis  process. 

3.3.3  Disturbances.  In  this  subsection,  potential  disturbances  to 
the  seat/pilot  system  are  identified  and  discussed. 

In  brief,  disturbances  are  those  phenomena  which  cannot  be  modeled 
well  in  the  expressions  for  the  control  design  system  dynamics,  or  which 
behave  on  the  system  in  a  random  manner.  A  proper  control  design  must 
nevertheless  be  able  to  accommodate  most  of  the  disturbances  likely  to  be 
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encountered  by  the  system.  In  order  to  simulate  disturbances  for  control 
design  and  verification,  they  are  divided  into  two  classes,  static  and 
dynamic.  Static  disturbances  represent  (unknown)  differences  between 
actual  and  modeled  parameter  values  which  remain  essentially  fixed  during 
an  escape  trajectory.  They  can  also  be  modeled  with  drift  rates.  The  bias 
value  and  drift  rate,  if  any,  can  be  modeled  as  random  values  with  given 
statistics.  Dynamic  disturbances  are  random  functions  in  time.  It  is 
usually  most  convenient  to  model  these  as  pure  or  filtered  white  noise  of  a 
given  power. 

Static  disturbances.  The  seat/pilot  TVC  system  must  be  designed  to 
control  disturbances  arising  from  variations  in  seat/pilot  weight,  moment 
of  inertia,  and  center  of  gravity  migration.  The  required  ranges  for  this 
variation  are  expressed  in  terms  of  median  pilot  weight;  the  control  system 
must  work  for  pilots  in  the  5-95  percentile  range.  The  control  system 
will  adjust  to  such  disturbances  automatically,  due  to  its  closed  loop 
nature.  Mass/inertia  properties  are  definitely  a  design  factor;  however, 
they  will  not  appear  as  specific  control  parameters  in  a  given  implemen¬ 
tation.  That  is,  the  pilot  will  not  be  required  to  dial  his  weight,  for 
example,  prior  to  a  mission,  nor  will  there  be  real-time  computation  or 
measurement  of  mass/inertia  properties.  The  extremes  of  the  mass/inertia 
variations  will  be  used  in  the  design  process  in  order  to  size  control 
system  components,  but  not  as  real  time  inputs.  The  effect  of  mass/lnertla 


variations  will  appear  implicitly  in  the  control  laws  derived. 


During  preliminary  design  studies  and  control  synthesis,  fixed  offset 
values  can  be  assigned  to  weight,  inertia  and  CG  values.  More  complete 
analyses  will  Include  dynamic  variations  in  these  quantities. 


Because  the  aerodynamic  forces  and  torques  are  the  major  concern  for 
the  escape  control  system,  aero  disturbances  must  be  modeled  adequately  in 
the  environmental  model  to  ensure  robust  controller  design.  In  much  the 
same  manner  as  the  mass/Inertia  related  variables,  quantities  such  as  the 
seat/pilot  aerodynamic  frontal  area  and  the  center  of  pressure  location 
(fore  and  aft,  as  well  as  sideways)  are  to  be  u3e<^  in  the  design,  but  not 
explicitly  in  implementation.  Other  disturbance  quantities  relating  to  the 


56 


aerodynamic  environment  are  the  main  atmospheric  variables:  pressure, 
temperature  and  altitude*  Of  these,  altitude  exhibits  uncertainties 
through  its  measurement.  Altitude  sensors  and  their  performance  are 
discussed  in  Section  5.5.  For  other  reasons,  e.g.,  steering  control,  good 
knowledge  of  altitude  is  important  for  effective  control  system  operation 
throughout  the  flight  envelope.  Disturbance  offsets  of  low  altitude  values 
will  be  used  for  robustness  and  verification  studies  of  the  control  system. 

Temperature  and  pressure  are  important  Influences  on  the  performance 
of  the  various  pyrotechnic  devices.  Their  direct  effect  on  aerodynamic 
response,  as  disturbances,  is  not  as  critical,  although  this  will  also  be 
studied  using  simulations  with  the  controller  design.  Energy  performance 
of  the  sustainer  propulsive  system  can  vary  up  to  50%  over  the  projected 
operational  temperature  range  of  about  -60  F  to  140  F.  This  information, 
if  known  to  the  controller,  can  greatly  reduce  undesired  uncertainty. 

Finally,  there  are  Important  static  disturbances  which  affect  rocket 
performance.  These  include  thrust  asymmetries  and  variations  In  burn  time 
and  thrust  profile.  The  control  design  must  accommodate  this  type  of 
disturbance,  without  explicitly  using  them  in  the  control  law. 

Dynamic  disturbances.  Most  of  the  quantities  defined  above  exhibit 
both  static  and  dynamic  disturbance  properties.  The  CG  may  be  offset  sta¬ 
tically  for  a  number  of  reasons,  but  in  all  cases,  it  will  migrate  with 
respect  to  the  seat  frame  throughout  the  escape  trajectory.  We  have  con¬ 
ducted  a  somewhat  limited  study  of  a  dynamic  single  mass  model  of  the  pilot 
moving  with  respect  to  the  seat.  See  Section  6.5.  While  the  control 
system  must  include  energy  sources  of  sufficient  size  to  control  the  CG 
migration,  it  will  be  design-limited  to  the  basic  5  -  95  %  values,  plus 
sideways  offsets  up  two  inches.  Side  forces  due  to  asymmetric  thrusting, 
as  well  as  angular  rates,  cause  even  a  well-harnessed  pilot  to  move  arms, 
legs  and/or  torso,  in  response  to  nominal  and  off-nominal  accelerations. 
Such  disturbances  were  only  Implicitly  modeled  for  the  current  control 
design  effort. 


Asymmetries  arising  from  the  position  of  legs,  arms,  etc.,  are 
relatively  minor  in  terms  of  effect  on  CG  location;  however,  they  have  a 
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very  large  effect  on  the  aerodynamic  forces.  Thus,  these  disturbances  must 
be  a  factor  in  the  control  design.  Another  point  to  make  is  that  CG  shifts 
have  a  noticeable  effect  on  moment  and  product  of  inertia  values, 
especially  the  latter.  Aerodynamic  disturbances  affect  motion  in  all  three 
dimensions.  They  are  due  to  asymmetric  positioning  of  hand/arm,  knee/leg, 
or  even  seat  asymmetries.  In  addition,  a  heavy  pilot  tends  to  contribute 
upper  torso  asymmetries,  and  the  whole  body  of  a  light  pilot  is  subject  to 
asymmetric  disturbances.  Other  major  aerodynamic  disturbances  arise  from 
vortex  shedding  and  turbulance  about  the  seat.  Vortex  shedding  occurs 
mostly  off  the  rear  of  the  seat,  but  also  from  all  protusions.  Turbulance 
arises  from  many  causes,  not  the  least  of  which  are  those  related  to 
airflow  about  the  open  cockpit  area  of  an  aircraft  at  a  disabled  attitude. 

It  is  necessary  to  conduct  a  complete  design  which  will  work  in  the 
presence  of  all  disturbances  cited  above.  The  static  disturbances  are 
generally  easy  to  model  in  the  6  DOF  simulator,  but  this  is  not  always  the 
case  for  the  dynamic  disturbances.  Many  of  the  realtlve  seat/pllot  motions 
are  simulated  in  EASIEST;  it  will  be  necessary  to  construct  appropriate 
EASIEST  turbulence  and  wind  gust  components. 

The  remaining  source  of  uncertainty  in  the  control  design  process  is 
in  the  area  of  measurement  sensor  disturbances.  Their  attributes  are 
discussed  in  Section  5.1.  We  mention  here  that  the  attributes  of  interest 
to  ejection  seat  TVC  design  include  accelerometer  noise  due  to  sensor 
start-up,  vibrational  noise  from  the  rocket,  and  modal  interaction  with  the 
seat  structure.  The  rate  gyros  have  a  major  source  of  error  due  to 
precession  in  an  acceleration  field. 

Appendix  E  presents  the  outline  for  an  algorithmic  means  of  dealing 
with  process  disturbances. 

3.3.4  Crew  Escape  Energy  Requirements.  In  this  subsection,  thrust 
energy  requirements  needed  for  safe  ejection  at  all  conditions  are 
discussed.  For  this  project,  the  control  system  must  ensure  pilot  survival 
from  sea  level  to  50,000  feet  altitude,  and  from  zero  ground  speed  (at  low 
altitudes)  to  velocities  equivalent  to  1600  Q  ("pounds  per  square  foot") 
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dynamic  pressure,  or  687  KEAS  (Figure  3.6).  The  control  logic  presented 
later  in  this  report  has  been  used  in  the  following  numerical  study. 

In  order  to  perform  the  analysis  required,  it  was  necessary  to  develop 
a  working  simulation  model  of  a  representative  rocket  nozzle  configuration. 
Such  a  module  converts  the  rocket  angular  and  translational  commands  into 
specific  thrust  magnitudes  and  orientations  for  each  nozzle  (motor) 
assembly.  This  "inversion"  problem  is  a  key  aspect  of  acceleration  control 
design. 

High  Q  escape  conditions  have  a  direct  bearing  on  energy  requirements, 
but  there  are  also  conditions  at  lower  speeds  which  must  be  considered. 

For  this  reason,  several  MIL-S  baseline  conditions  are  used  in  quantifying 
thrust  energy  requirements. 

3. 3. 4.1  Energy  Requirements  and  MIL-S  Escape  Conditions.  As  stated 
above,  the  main  driver  for  determining  required  thrust  energy  is  the  high  Q 
escape  region.  This  manifests  itself  both  in  attitude  and  steering  control 
requirements.  At  high  speeds,  aerodynamic  deceleration  is  so  severe  that 
several  fatal  scenarios  may  develop:  the  seat  can  be  blown  into  the 
vertical  stabilizer(s)  or  some  otherpart  of  the  aircraft;  the  seat 
attitude  or  the  size  of  the  aero-indiiced  g  forces  can  be  such  that  the 
acceleration  environment  is  not  survlvable  (loads  of  approximately  30  g's 
short  duration  can  be  tolerated,  but  only  if  pointed  normal  to  the  pilot’s 
chest;  spinal  or  lateral  load  factor  tolerance  is  much  less,  about  one 
half);  and,  the  aero  forces  acting  on  the  seat  cause  unstable  attitude 
behavior,  which  at  best  jeopardizes  steering  control  (e.g.,  altitude  gain), 
and  at  worst  can  convert  a  survivable  attitude  into  a  fatal  one. 

The  controller  developed  by  SSI  is  well  suited  for  meeting  control 
objectives  and  for  performing  in  this  harsh  environment.  This  is  because 
it  operates  directly  on  accelerations:  force  and  torque  accelerations  are 
its  primary  commanded  outputs.  An  input  quantity,  the  desired  final 
acceleration,  is  also  a  key  trajectory  shaping  parameter. 

At  high  Q,  energy  requirements  are  dictated  both  by  immediate  issues 
of  survivability,  and  by  the  need  to  decelerate  enough  over  the  powered 


phase  of  Che  ejection  so  that  the  main  chute  Is  safely  deployed.  These 
constraints  dictate  required  propulsive  Impulse,  and  hence  burn-time 
limits.  Dynamic  pressure  Is  a  key  "decision  variable"  In  high  Q  escape. 
That  is,  it  is  a  key  part  of  the  controller  logic. 

One  potential  concern  In  low  Q  escapes  Is  that  the  energy  needed  at 
high  Q  can  be  fatally  excessive  at  low  speeds.  Thrust  modulation  is  a 
sound  requirement  for  a  design  capable  of  operation  over  all  regimes.  The 
low  Q  cases  can  establish  a  "floor"  on  energy  requirements:  enough 
vertical  acceleration  is  still  needed  for  aircraft  aviodance,  and  to  orient 
the  seat  properly  for  chute  deployment.  Variable  catapult  thrust  is  also 
needed  so  that  smooth  acceleration  profiles  obtain  at  all  times  on  the 
ejectee.  But  there  are  also  high  energy  requirements  at  low  Q.  This  will 
occur  in  many  of  the  low  altitude,  adverse  attitude  cases  such  as  are  found 
in  MIL-S-9479B.  Our  studies,  discussed  in  this  chapter,  indicate  that, 
while  energy  comparable  to  high  Q  cases  may  be  needed  at  lower  speeds,  the 
upper  extreme  of  energy  requirements  is  still  dictated  by  high  Q 
conditions. 

An  important  factor  in  the  design  of  acceptable  escape  trajectories  is 
the  burn  time  of  the  sustalner  rocket.  See  the  Case  6  discussion.  The 
reference  run  is  shown  in  Figure  3.7,  and  had  a  duration  of  250  msec. 

In  all  of  the  simulation  results  presented  in  this  report  time  (t)=0 
corresponds  to  the  instant  of  sustalner  rocket  ignition.  This  point  in 
time  typically  occurs  after  tip  off,  so  that  we  are  in  effect  also  assuming 
that  the  motion  begins  in  free  stream  air.  Refer  to  the  Glossary  for  a 
definition  of  symbols. 

Figures  3.8  and  3.9  show  the  same  run,  except  that  burn  times  are  600 
and  900  msec,  respectively.  In  both  cases,  there  is  adequate  attitude  and 
trajectory  control  for  escape,  although  comparison  of  the  original  and 
these  two  results  tends  to  favor  a  burn  time  close  to  600  msec  for  this 
condition.  There  is  excess  thrust  capacity,  no  problem  with  the  Radical 
response,  and  reasonable  thrust  vectoring  response.  There  is  no  question 
in  Figure  3.8  that  pitch,  roll  and  yaw  are  well  controlled,  and  the  angular 
rates  decay  acceptably. 
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The  Figure  3.9  result  shows  that  the  extended  burn  time  has  Induced 
more  oscillatory  behavior  in  the  attitude  variables,  even  at  the  early 
phase  of  the  trajectory.  A  comparison  of  the  roll  plots  in  Figures  3.8  and 
3.9  shows  convincingly  the  nonlinear  nature  of  the  problem,  since  only  the 
burn  time  was  changed  in  the  two  runs. 

3. 3. 4. 2  Rocket  Sizing  Analysis.  The  study  conducted  in  this 
subsection  investigates  the  basic  energy  requirements  for  the  escape 
conditions  discussed  in  Section  3.3.4,  along  with  the  low  altitude,  high  Q 
case  originally  presented  in  the  Task  2  Interim  Report  (Figure  5.5).  The 
data  were  c  jmputed  by  taking  the  commanded  rocket  force  and  torque  at  each 
control  update  time.  The  moment  arm  at  each  time  was  computed  by  dividing 
the  torque  magnitude  by  the  magnitude  of  the  force  vector  component 
perpendicular  to  the  torque  vector.  Presented  here  are  maximum  values  for 
the  quantities  force  and  torque  magnitude,  and  moment  arm.  These  values  do 
not  always  occur  siumultaneously ,  but  they  do  tend  to  occur  during  about 
the  first  third  of  the  rocket  burn. 

The  cases  in  Table  3.1  generate  the  following  energy  requirements: 
for  Condition  1,  force  =  2856  pounds,  torque  =  1597  ft-pounds,  and  moment 
arm  =  7  inches;  for  Condition  2,  force  =  4166  pounds,  torque  =  2774 
ft-pounds,  and  moment  arm  =  22  inches;  for  condition  3,  force  =  4998 
pounds,  torque  =  3228  ft-pounds,  and  moment  arm  *  14  inches;  and  for 
Condition  4,  force  =  3029  pounds,  torque  =*  1819  ft-pounds,  and  moment  arm  = 
7.5  inches.  Case  6  shows  the  highest  energy  demand  of  the  seven  MIL-S 
cases. 


The  high  Q  ejection  condition  is  more  appropriate  for  sizing  the  upper 
limits  of  the  energy  requirements,  although  Inspection  of  adverse  attitude 
cases  is  necessary  to  determine  energy  needed  to  gain  sufficient  altitude, 
as  well  as  correct  the  attitude  properly.  For  the  high  Q  case  presented  as 
Figure  5.5  of  the  Interim  Report,  there  is  a  maximum  force  requirement  of 
11,488  pounds,  torque  =  4492  ft-pounds,  and  moment  arm  =  11.5  inches.  This 
has  been  improved  with  more  detailed  analysis  of  this  condition,  presented 
below. 
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Figure  3.10  shows  the  case  In  which  there  is  no  thrust  magnitude 
limiting.  Except  for  possibly  excessive  energy  requirements,  however,  the 
results  are  very  good.  ZVEL,  the  body  z-axis  velocity  component  stays 
large  and  negative,  which  means  altitude  gain.  The  decrease  In  ZVEL's 
magnitude  toward  the  end  reflects  control  to  the  Input  desired  final 
acceleration,  a  quantity  which  can  also  be  “optimized”.  Similarly,  XVEL 
decelerates  for  a  while,  but  also  responds  to  a(tf).  Plots  of  CG  motion. 
Figure  3.10(b),  show  the  altitude  gain  clearly,  and  the  basically  planar 
motion  which  Indicates  that  the  controller  is  performing  well.  Attitude 
rates,  shown  In  Figure  3.10(c)  in  deg/sec,  are  also  very  good,  except 
perhaps  for  roll  rate  Just  before  thrust  cutoff.  Roll  angle  is  drifting  a 
bit,  but  is  not  too  tightly  controlled  anyway  at  these  values.  Yaw  is  very 
well  controlled,  which  is  critical  at  this  speed,  and  the  pitch  response 
does  not  show  quite  enough  control  authority,  although  it  has  begun  to 
correct  itself.  Particularly  interesting  about  this  run  Is  that  the 
controller  gains  were  not  greatly  changed  from  those  used  in  the  low  Q 
cases  reported  on  earlier.  Thus,  a  little  more  "tuning"  of  these  gains, 
which  are  constant  over  a  given  run,  as  well  as  the  nozzle  and  burn  time 
parameters,  will  certainly  lead  to  Improvements. 

Rocket  motor  results  are  plotted  for  this  run  in  Figures  3.10(e“g). 
Nozzles  1  and  2  here  are  the  "verniers",  located  off  the  pilot's  shoulders 
in  this  case,  and  sized  for  about  2000  pounds  thrust  capacity  apiece  (see 
Figure  3.4).  TMAGl  and  TMAG2  plots  show  that  lesser  amounts  are  used. 

Pitch  and  roll  angles  are  defined  for  each  nozzle.  The  pitch  direction  is 
forward  and  back,  and  the  roll  is  left-right.  The  plotted  angles  are 
values  with  respect  to  a  nominal  orientation,  in  a  positive  rotation  sense 
in  body  axes.  The  nominal  thrust  direction  for  the  verniers,  nozzles  I  and 
2,  was  arbitrarily  set  to  be  forward.  Nozzle  3,  located  basically  where 
the  current  ACES  II  nozzle  is,  but  sized  at  about  twice  the  energy,  has 
pitch  vectoring  only.  Its  nominal  direction  is  such  that  a  pitch  torque  is 
generated  which  offsets  the  aerodynamic  torque  at  1600  Q.  This  offset  is 
varied  via  input  data  to  the  program,  for  all  nozzles,  as  well  as  their 
locations,  nominal  magnitudes,  and  thrust  limits. 

The  verniers  are  now  conceived  as  being  basically  fast  responding, 
RC'-type  thrusters,  which  can  change  thrust  very  fast  in  nearly  all 
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directions.  Rocket  3  can  be  considered  to  have  a  gimballed  nozzle,  whose 
cone  angle  is  limited  to  about  30  degrees. 

Summarizing,  the  controller  module  issues  commanded  (net)  rocket  force 
and  torque  vectors,  (frc,  trc).  These  are  plotted  in  Figure  3.10(h,i)  for 
this  case.  The  actuator  module  converts  (frc,  trc)  into  nozzle  angles  and 
thrust  magnitudes  for  a  given  configuration,  e.g..  Figures  4(e-g).  There 
are  8  such  quantities  in  this  configuration,  which  become  elements  of  the 
control  vector,  uc.  System  dynamics  are  a  nonlinear  function  of  uc. 


CHAPTER  4 


TASK  2:  CONTROL  LOCIC  DESIGN 


The  main  objective  of  Task  2  is  to  demonstrate  the  feasibility  of 
vectored  thrust  control  for  the  ejection  seat  by  synthesizing  a  control 
methodology.  The  highly  nonlinear  and  variable  dynamics  of  the  ejection 
seat,  enlarged  flight  envelope  and  the  lack  of  previous  experience  in 
applying  the  vectored  thrust  control  concept  to  ejection  seat  makes  the 
feasibility  demonstration  a  challenging  and  key  problem, 

A  review  of  a  large  number  of  control  concepts  by  SSI  revealed  the 
fact  that  majority  of  the  control  design  schemes  cannot  be  applied  directly 
to  the  ejection  seat  problem  (Section  4.2).  The  highly  nonlinear  dynamics 
and  short  trajectory  duration  rule  out  the  possibility  of  using  purely 
linear  design  techniques  such  as  LQG,  frequency  domain,  pole  placement, 
etc.  It  was  realized  that  nonlinear  reference  trajectory  methods,  both 
real  time  and  off-line  optimal,  need  to  be  employed  to  determine 
feasibility  under  extreme  ejection  conditions  such  as  high  Q  (dynamic 
pressure)  and  adverse  attitude  ejections.  Therefore,  a  large  part  of  the 
Task  2  effort  was  devoted  to  solving  for  optimal  trajectories  using  ESOP 
(Ejection  Seat  Optimization  Program).  Then  the  issues  of  robustness  and 
on-line  implementation  of  optimal  solutions  were  addressed.  The  results 
obtained  (Volume  II,  Chapter  7)  demonstrate  the  practicality  of  the 
vectored  thrust  control  concept.  Rased  on  these  results,  one  can  assert 
with  great  confidence  that  an  integrated  design  approach  is  capable  of 
meeting  all  the  specifications  using  near-term  state-of-the-art  hardware 
technologies. 

In  presenting  the  control  law  design,  this  chapter  is  broken  into 
three  main  sections.  Section  4.1  describes  the  special  features  and 
problems  associated  with  control  of  ejection  seats.  Section  4.2  reviews 
candidate  control  approaches,  and  Section  4.3  describes  in  detail 
predictive  acceleration  control,  the  selected  approach. 
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A. I  Unique  Features,  Problems  In  Ejection  Seat:  Control. 

There  are  many  design  Issues  which  relate  to  vectored  thrust  control 
of  ejection  seats  which  must  be  addressed  before  the  design  can  be 
finalized*  For  example,  it  is  necessary  to  assimilate  data  on  hardware 
components,  model  these  Into  the  system,  and  "fine  tune”  the  controller. 
Other  details  relating  to  reliability  issues,  redundancy  management  and 
fault  tolerance  must  be  addressed  by  follow-on  projects. 

We  have  focused  on  control  of  the  seat/pilot  system  once  the  rocket 
thrusters  are  on  and  it  is  free  of  the  rails.  The  total  control  system 
must  also  address  the  catapult  phase  of  the  ejection  -  the  portion  of  the 
trajectory  from  catapult  ignition  to  rail  separation.  It  is  during  this 
time  that  the  system,  fully  activated,  must  sequence  sensor  start-up, 
detect  the  flight  condition,  establish  the  sequence  for  catapult  operation, 
chute  deployment,  etc.,  set  nominal  thrust  levels  both  for  the  rocket(s) 
and  catapult(s),  and  compute/select  the  appropriate  reference  optimal 
trajectory. 

As  the  sensors  come  on  line  (this  must  happen  within  0.08  to  O.IO 
seconds  after  catapult  ignition) ,  they  must  provide  relevant  information 
from  the  environment  so  that  the  rocket  nozzles  can  be  gimballed  (or 
appropriate  RCS  nozzles  selected)  to  the  proper  settings  for  the  escape 
condition.  In  this  way,  the  system  would  be  optimally  configured  to  handle 
its  environment  once  totally  free  of  the  rails.  Sensor  information  will 
also  be  used  to  modulate  the  catapult  thrust  level,  as  required  by  the 
given  condition.  Closely  related  to  these  design  issues  is  the  effect  of 
sensor  noise  on  overall  system  performance.  Sufficiently  accurate, 
reliable  sensors  may  result  in  a  simpler  design,  with  less  need  for 
redundancy  and/or  real  time  estimation. 

When  all  but  the  last  set  of  rail  blocks  are  free,  the  seat/pilot 
system  has  a  degree  of  freedom  in  pitch.  The  rocket  should  be  on  by  this 
time,  providing  the  required  forces  and  restoring  torques. 

Event  sequencing  will  be  controlled  from  the  microprocessor,  aided  by 
a  clock  and  sensor  input.  There  likely  will  be  more  than  one  sample  rate. 
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the  rates  ranging  from  50  Hz  to  as  much  as  500  Hz.  With  the  capability  for 
extremely  high  rates  being  generated,  it  is  vital  that  aliasing  be  avoided. 
Control  rates  are  thus  an  important  design  issue.  The  attitude  control 
loop  is  the  most  critical;  the  system  presented  here  does  not  require  that 
the  desired  attitude  at  any  instant  be  attained  in  order  to  issue 
appropriate  steering  commands.  Control  activity  is  decoupled,  but  it  is 
recognized  that  the  basic  problem  is  a  highly  coupled  6  DOF  problem.  This 
is  to  say,  for  example,  that  success  in  attitude  control  has  direct  bearing 
on  effectiveness  of  steering  control. 

4.1.1  Development  of  Control  Design  Methodology.  In  this  chapter,  we 
present  the  overall  vectored  thrust  control  requirements  for  crew  escape, 
as  well  as  the  design  methodology  which  we  feel  is  most  appropriate  for 
developing  an  effective  and  efficient  control  system.  The  control 
requirements  presented  here  are,  in  effect,  qualitative  control  system 
specifications. 

The  control  design  approach  must  reflect  the  realities  of  the  plant 
which  is  to  be  controlled.  In  the  case  of  a  detached  ejection  seat  with 
crewperson  ("seat/pilot")  system,  the  extreme  conditions  of  altitude, 
airspeed,  and  orientation  can  combine  to  pose  a  severely  constrained 
optimization  problem.  In  addition,  it  is  a  problem  which  does  not  readily 
lend  itself  to  classic,  or  even  classic/optimal  design  techniques,  because 
in  addition  to  the  above  constraints,  the  seat/pilot  system  in  an  airflow 
is  highly  nonlinear.  The  dynamic  nonlinearity  is  further  enhanced  by 
nonlinearities  due  to  energy  source  fuel  consumption  (mass  change  effect)  , 
and  "discrete"  mass  changes  due  to  deployment  of  various  devices  during  the 
ejection  sequence. 

For  these  reasons,  and  they  have  been  confirmed  over  the  past  few 
months  by  simulations  and  discussions  with  seat  designers,  the  standard 
linear  quadratic  regulator  (LQR)  approach  by  itself  is  felt  to  be  overly 
inadequate  for  this  job  ,  even  assuming  that  it  can  be  implemented  at  all. 
Our  approach  is,  in  summary,  to  use  powerful  techniques  based  on  nonlinear 
acceleration  control  whose  features  are  geared  more  appropriately  to  this 
type  of  control  problem.  The  idea  is  to  run  several  detailed  off-line 


solutions  for  optimal  escape  trajectories,  the  appropriate  one  of  which 
could  then  be  retrieved  from  storage  and  implemented  in  real  time  with 
linear  perturbation  optimal  control  augmentation* or ,  to  generate  suboptimal 
"on-line"  trajectories,  using  sets  of  key  pre-stored  parameters  to  shape 
them  depending  on  the  condition. 

4.2  Review  of  Candidate  Control  Synthesis  Techniques. 

Although  we  feel  that  the  primary  approach  presented  in  this  report  is 
very  capable  of  working  efficiently  throughout  the  MIL-S-9479  "escape 
envelope" ,  it  is  also  important  to  investigate  other  methodologies  which 
offer  potential  for  useful  application  instead  of,  or  in  conjunction  with, 
the  method  presented.  Such  a  survey  has  become  increasingly  more  important 
as  interest  has  grown  in  this  project;  however,  a  comprehensive  effort  in 
this  direction  is  beyond  the  scope  of  the  current  effort.  We  do  propose, 
however,  to  look  closely  at  the  more  promising  of  the  alternative 
approaches,  and  consider  seriously  their  role  as  part  of  the  overall 
design. 

The  common  requirements  which  any  method  under  consideration  must  have 
are:  (1)  an  ability  to  work  in  a  dynamic  environment  which  is  at  best 
poorly  modeled  by  an  LTI  (linear  time-invariant)  system;  (2)  predictive 
ability;  (3)  amenability  to  real  time  implementation;  and  (4)  ability  to 
adapt  well  in  the  presence  of  unanticipated  disturbances,  poor  initial 
conditions,  etc. 


These  requirements  eliminate  many  of  the  standard  classical  and 
optimal  design  methods,  and  make  quite  difficult,  if  not  impossible,  the 
application  of  standard  optimal  control  synthesis  methods  such  as  LQG 
(linear  quadratic  gaussian) .  The  search  focuses,  then,  to  those  methods 
capable  of  multivariable  synthesis  of  systems  whose  system  (Jacobian) 
matrix  elements  vary  widely  over  the  flight  regime.  Section  4.2.3 
discusses  briefly  an  appealing  method  of  this  type. 

An  inspection  of  escape  trajectories  reveals  why  standard  linear 
control  synthesis  techniques  would  not  be  adequate  for  this  problem. 
Uncontrolled  trajectories  show  significant  variation  in  the  system  Jacobian 
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matrix  elements  even  over  periods  as  small  as  0.01  seconds,  as  seen  in 
Figure  4.1,  where  the  system  matrix  is  compared  at  t=0.0  (Figure  4.1a)  and 

t=0.1  seconds  (Figure  4.1b).  There  is  improvement  when  the  trajectory  is 

"controlled",  as  seen  in  Figure  4.2,  but  robustness  is  always  a  concern 
with  such  designs. 

4.2.1  LQR  Design.  The  purpose  of  LQR  design  is  to  stabilize  the  seat 
around  a  nominal  trajectory  using  vernier  rocket  thrust  via  feedback  from 
sensed  angular  rates,  attitude,  accelerations,  etc.,  for  disturbance 
rejection  and  pilot  load  minimization.  LQR  design  is  based  on  the 
linearized  models  developed  in  Section  3.2  and  a  performance  index  based  on 
the  minimization  of  deviations  from  the  nominal  trajectory.  LQR  designs 
can  be  computed  using  OPTSYS  III  software  described  in  section  4.3.3.  The 

purpose  of  LQR  design  is  to  place  all  the  poles  of  the  system  in  the 

left-half  plane  for  different  flight  conditions  to  achieve  stability  and 
robustness.  This  would  most  likely  require  time  varying  gains  which  will 
be  computed  off-line  and  stored  in  the  microprocessor  memory  for  online 
retrieval . 

The  LQR  design  process  begins  with  the  deterministic  first  order 
linear  constant  coefficient  set  of  equations,  (A. 2),  which  are  rewritten 
here  in  compact  form 

x=Ax+Bu  (4.1) 

Disturbance  and  other  random  effects  are  modeled  by  adding  to  Equation 
(4.1)  process  noise  terms  of  the  form  Pw  where  w  is  a  vector  of  random 
variables  with  quantifiable  statistics,  and  F  is  an  appropriate  constant 
matrix.  Continuous  or  sampled  measurement  equations  of  the  form 

y(L)  =  Cx(t)  +  V  (4.2) 

complete  the  dynamic  representation  of  the  system  (v  is  measurement  noise. 
See  Appendix  F,  for  a  treatment  of  estimating  x  in  the  presence  of  w  and  v). 

In  our  application,  the  LQR  optimization  process  would  be  done  about  a 
reference  optimal  solution,  (x,u),  generated  off-line  by  means  of  a 


nonlinear  programming  technique  such  as  ESOP  (Subsection  4.2.4).  Equations 
(A. 2)  are  designed  to  be  formulated  about  a  general  reference  trajectory. 
The  cost  function  for  the  off-line  nonlinear  solution  may  be  of  the  form 


min  J  =  I  [(Radical) 2  +  I/2  x'^^Qx  +  I/2  u'^Ru]  (4. 

u  to 

where  the  event  times  tQ  and  tp  represent  the  initiation  and  termination, 
respectively,  of  the  sustainer  rocket  phase,  and  the  acceleration  radical 
is  given  in  Equation  (3.34).  Minimization  of  (4.3)  is  done  subject  to 
equality  and  inequality  constraints  of  the  form 


(Equality) 

g(X,U)  =  0. 

(4.4) 

( Inequality) 

h(X,IJ)  <  0. 

(4.5) 

Xt<  X  <Xu 

(4.6) 

Uji<  U  <Uu 

(4.7) 

where  X  is  the  string  of  state  variables  at  each  sample  time,  i.e, 

[xo,xi , ,  ,Xf^J  ,  and  U  is  similar  for  the  control  vectors.  The  equality 
constraints  (4.4)  are  the  dynamic  equations  (A.l),  and  the  inequality 
constraints  quantify  requirements  such  as  altitude,  seat-aircraft 
separation  and  TVC  constraints.  These  constraints  are  presented  in  Section 
3.3.  Subscripts  in  Equations  (4.6)  and  (4.7)  refer  to  appropriate  lower 
and  upper  bounds  for  state  and  control  variables. 

The  cost  function  is  itself  a  function  of  the  spinal  compression 
deflection  and  rate,  as  given  in  the  DRI  expression  in  MIL-S-9479B,  and 
also  of  the  seat/pilot  load  factors.  Equations  (A.l),  and  finally,  of 
specific,  condition-dependent  state  and  control  quadratic  elements. 

The  LQR  cost  and  constraints  are  obtained  by  linearization  of 
Equations  (4.3  to  4.7)  around  the  off-line-generated  optimal  solutions 
using  the  ESOP  approach.  The  LQR  phase  in  the  design  process  effectively 
closes  the  loop,  so  that  control  is  stable  in  the  presence  of  process  and 
measurement  disturbances  for  a  specific  escape  trajectory. 


97 


.v.V 


A  major  object  of  the  LQR  design  is  that  it  ensure  a  stable  closed 
loop  system  for  the  combined  MAC-MINOS  based  outer  loop  control  to  operate 
on.  One  technique  for  assuming  stability  is  left  half  plane  pole  placement 
which  can  be  achieved  by  minimizing  a  quadratic  cost  function  which  goes  to 
zero  when  the  eigenvalues  of  the  closed  loop  system  are  at  the  desired 
stable  locations.  The  technique  reduces  to  the  solution  of  an  n(n-m)  th 
order  linear  algebraic  system,  where  n  is  the  state  dimension,  and  ra  is  the 
control  variable  dimension. 

Linear  Operating  Points.  The  very  nonlinear  nature  of  the  seat/pilot 
dynamic  system  requires  great  care  whenever  linearization  assumptions  are 
made.  We  have  therefore  presented  a  very  general  set  of  linear  equations 
(A. 2).  These  are  designed  to  be  used  about  any  nominal  trajectory,  stable 
or  not  (although  the  latter  will  work  only  for  a  brief  time  interval).  It 
is  necessary,  however,  to  choose  carefully  the  points  along  a  given 
trajectory  where  linearization  makes  most  sense.  From  our  experience,  a 
single  linearization  will  not  suffice  over  a  given  trajectory. 

Fortunately,  EASIEST  or  the  SSI-developed  control  design  software  can 
perform  numerical  system  linearization  at  any  desired  point(s). 

4.2.2  Model  Algorithmic  Control  (MAC)  Design.  It  is  possible  to 
consider  a  MAC  design  approach  for  modulating  the  main  thrust  on-line  to 
keep  the  seat  on  the  preselected  optimal  trajectory  while  minimizing  pilot 
acceleration  loads.  The  MAC  design  approach  has  been  described  in  Mehra  et 
al.  (1980)  and  consists  of  predicting  the  future  motions  of  the  system  and 
taking  corrective  actions  to  keep  all  the  constraints  satisfied.  In 
essence,  the  MAC  approach  implements  the  trajectory  optimization  procedure 
on-line  to  compensate  for  stochastic  deviations  from  the  open  loop  optimal 
trajectories.  MAC  design  is  more  appropriate  for  this  application  compared 
to  LQR  since  hard  constraints  on  states  and  controls  have  to  be  kept 
satisfied . 

The  following  description  is  intended  to  provide  background 
information  on  the  MAC  philosophy.  With  this  information,  it  can  be  seen 
how  critical  MAC  concepts  relate  to  the  crew  escape  control  logic  design 
actually  developed.  In  particular,  ideas  common  both  to  MAC  and 


acceleration  control  include:  (i)  internal  model  of  the  system;  (ii) 
hierarchical  structure;  and  (ili)  use  of  reference  trajectories.  The  main 
features  and  philosophy  of  MAC  are  discussed.  Next,  MAC  implementation  and 
algorithms  are  outlined.  A  fairly  complete  bibliography  is  Included  for 
further  information. 

Historical  Overview.  Model  Algorithmic  Control  was  first  conceived  by 
Adersa/  Gerbios  in  the  late  I960’s.  (Richalet  and  Gimoret  1968,  Lecamus 
and  Richalet  1968;  Richalet,  Lecamus  and  Hummel  1970;  Richalet,  Rault, 
Pouliquen  1971).  The  method  was  subsequently  developed  and  applied 
successfully  to  several  industrial  processes  involving  multivariable  plant 
dynamics.  With  the  growth  of  digital  technology  in  the  70 's  and 
particularly  the  availability  of  powerful  microprocessors  with  large 
memories,  the  application  of  MAC  to  Industrial  processes  became  more 
practical  and  economical.  For  instance,  in  the  past  five  years,  MAC  has 
been  successfully  used  for  Aircraft  Flight  Control  (Rault  et  al.  1975), 
Superheater  Control  (Testud  1977),  On-Line  Control  of  Steam  Generator 
(Lecrique  et  al.  1978),  European  Transonic  Wind  Tunnel  Control  (Mereau  and 
Littman,  1978),  F-lOO  Jet  Engine  Multivariable  Control  (Mehra  et  al.  1977), 
Adaptive  Flight  Control  (Mehra  et  al.  1978)  and  Electric  Plant  Control 
(Mehra  et  al.  (1980)).  Recently  attention  has  also  been  focused  on 
theoretical  properties  of  MAC  to  gain  a  better  understanding  for  design 
purposes.  These  theoretical  results  are  reported  in  Richalet  et  al. 

(1978),  Mehra  et  al.  (1979),  Praly  (1979),  Mehra  et  al.  (1980),  Mehra  and 
Rouhani  (1980)  and  Reid  et  al.  (1980). 

Basic  Principles  of  Model  Algorithmic  Control  (MAC).  The  MAC  strategy 
relies  on  the  following  four  features:  (i)  internal  model  of  the  system; 

( ii)  hierarchical  decomposition;  (iii)  reference  trajectory  and  output 
constraints;  and  (iv)  control  trajectory  computation. 

Internal  Model  of  the  System.  The  multivariable  system  to  be 
controlled  is  represented  by  a  mathematical  model  in  time-domain  of  the 
input-output  type  (see  Figure  A. 3).  For  linear  systems,  the  model  may  be 
of  the  impulse  response  type,  a  representation  which  has  certain  distinct 
advantages  over  the  state  space  representation  or  the  transfer  function 


representation  for  multivariable  control.  For  nonlinear  systems,  both  the 
state  space  and  the  input-output  representations  have  certain  advantages 
and  disadvantages.  In  applications,  one  may  use  either  or  both  depending 
upon  the  nature  of  nonlinearities  and  the  complexity  of  the  resulting 
controller.  The  purpose  of  the  Internal  model  is  to  have  a  flexible 
representation  of  the  controlled  system  stored  in  the  computer  memory, 
which  can  be  updated  as  the  system  changes  and  which  can  be  used  at  any 
instant  to  predict  the  future  behavior  of  the  system  under  different 
control  inputs.  The  internal  model  of  the  system  is  used  to  compute 
optimal  inputs,  to  detect  process  changes,  sensor  malfunctions  and  severe 
faults.  The  inputs  and  current  output  of  the  internal  model  are  updated 
according  to  the  actual  observed  values  of  these  variables,  but  any  large 
difference  between  the  computed  and  the  actual  values  gives  important  clues 
as  to  the  malfunctioning  of  sensors  and  actuators. 

The  internal  model  of  the  system  is  generally  obtained  via  off-line 
identification,  using  either  a  physical  model  structure  when  one  is  easily 
available  or  an  input-output  representation  model  such  as  the  impulse 
response  model,  which  may  change  with  the  operating  point.  Some  form  of 
on-line  parameter  identification  may  also  be  done  in  those  cases  where 
large  random  variations  of  system  parameters  are  expected.  It  has  been 
found  from  experience  that  the  robustness  of  MAC  is  sufficient  to  take  care 
of  small  parameter  changes. 

Reference  Trajectory  and  Output  Constraints.  The  desired  response  of 
the  closed-loop  system  is  specified  in  the  form  of  a  reference  trajectory 
and  constraints  which  are  updated  on-line  using  the  actual  output  of  the 
system.  It  is  possible  to  handle  state-dependent  constraints  in  this 
fashion  and  to  eliminate  the  steady  state  offset  error.  It  should  be 
noticed  that  the  specification  of  reference  trajectories  and  constraints  is 
much  easier  and  natural  than  the  specification  of  a  scalar  performance 
index.  Typically,  the  requirements  on  controlled  outputs  are  stated  as  "no 
overshoot,"  "fast  response,"  "within  maximum  and  minimum  limits,"  etc. 

These  requirements  are  difficult  to  express  in  a  scalar  quadratic 
performance  index,  but  they  are  easily  converted  into  desired  trajectories 
and  constraints  which  can  also  be  explained  to  the  operators  without  any 
difficulty. 


The  concept  of  using  reference  trajectories  is  more  general  than 
model-following.  First,  it  may  not  be  possible  to  represent  a  reference 
trajectory  by  a  simple  model,  and  second,  under  sensor  or  actuator  fault 
conditions,  one  may  have  to  relax  the  system  requirements  to  control  within 
a  band.  Certain  control  problems  such  as  water  level  control  involving 
Inexact  measurement  of  the  water  level  are  formulated  more  naturally  as 
band-control  problems  rather  than  model-following  or  scalar  performance 
index  problems. 

Control  Trajectory  Computation.  Controls  are  computed,  in  general, 
for  a  number  of  future  time  points  using  an  iterative  optimization 
technique  which  minimizes  the  distance  between  the  desired  reference 
trajectory  and  output  trajectory  predicted  by  the  internal  model,  while 
keeping  all  the  output,  state  and  control  constraints  satisfied.  The 
complexity  of  the  control  algorithm  is  directly  dependent  on  the  structure 
of  the  internal  model,  the  number  of  inputs  and  outputs  and  the 
constraints.  For  linear  systems,  the  impulse  response  representation 
results  in  a  simple  projection-type  quadratic  programming  solution  which 
can  be  implemented  quite  fast  in  micro/mini-computers  of  the  present 
generation.  The  actual  dimensionality  of  the  state  does  not  increase  the 
complexity  of  the  algorithm  as  it  would  in  a  state  vector  representation. 

In  order  for  this  approach  to  be  feasible,  a  countable  number  (say,  50)  of 
impulse  response  delays  must  be  stored.  This  implies  that  the  plant  to  be 
controlled  should  be  stable,  so  that  a  finite  representation  of  the  impulse 
response  function  is  valid. 

The  MAC  design  approach  has  been  found  to  be  flexible  and  robust.  It 
is  well  suited  for  the  evolving  microprocessor  technology  providing  high 
speed  memory  and  fast  computation  times  for  basic  calculations  such  as 
convolutions.  The  universality  of  the  impulse  response  representation 
leads  to  a  unified  design  approach  for  systems  of  all  orders.  Furthermore, 
the  parameter-linearity  of  this  representation  leads  to  a  duality  between 
identification  and  control. 


The  MAC  is  implemented  by  a  program  called  IDCOM.  The  special 
features  of  IDCOM  are:  (i)  no  model  order  reduction  is  required  since  an 


impulse  response  representation  is  used.  ( ii)  Input  magnitude  and  rate 
constraints  are  handled  directly  and  exactly,  (iii)  The  control  law  is 
time-varying  and  the  closed  loop  response  is  robust  to  parameter  changes. 

( iv)  Gain  scheduling  is  replaced  by  on-line  updating  of  the  internal  model 
using  operating  data  and  parameter  estimation  techniques,  thereby  reducing 
reliance  on  theoretical  models  of  the  system,  (v)  Same  algorithm  is  used 
for  impulse  response  identification  and  for  control  law  computation, 
thereby  simplifying  the  hardware  requirements,  (vi)  Different  sampling 
rates  can  be  used  for  controlling  different  outputs,  (vii)  The  control 
laws  can  be  modified  on-line  in  case  of  sensor  failures  or  degraded  system 
performance. 

IDCOM  Implementation.  A  block  diagram  of  IDCOM  is  shown  in  Figure 
(4.4).  As  indicated  in  the  figure,  when  a  new  measurement  is  made,  it  is 
fed  to  two  IDCOM  modules  which  compute  a  reference  trajectory  and  a  "zero 
output"  prediction  of  the  future  outputs  over  a  short  horizon  (for 
optimization).  The  reference  trajectory  is  usually  a  first-order 
exponential  drawn  from  the  current  (measured)  output  to  a  given  set  point. 
The  designer  supplies  a  time  constant  (t^)  for  this  exponential  for  each 
output  i.  The  "zero-input"  prediction  uses  the  past  inputs,  measurements, 
and  internal  impulse-response  model  to  predict  the  future  outputs  in  the 
absence  of  future  control  inputs. 

These  two  trajectories  (reference  and  zero-input  prediction)  are 
differenced  to  obtain  an  error  trajectory  to  be  minimized  by  the  future 
controls.  The  control  calculation  block  then  performs  this  minimization  in 
one  of  several  ways.  Once  an  input  sequence  has  been  computed,  the  first 
input  is  applied  to  the  plant,  and  the  cycle  starts  again  after  the  next 
measurement . 

Similar  Approaches.  Some  of  the  other  modern  control  approaches  which 
are  closer  to  MAC  are  Dynamic  Matrix  Control  (Cutler  et  al.  (IhSO)  Model 
Reference  Adaptive  (Landau  (1974))  and  Self  Tuning  Regulators  (Astrom 
(1980)).  They  are,  however,  not  exactly  similar  since  the  specification  of 
models  (reference,  prediction,  control)  and  algorithmic  computations  are 
done  differently.  Model  Reference  Adaptive  (MRA)  techniques  try  to  reduce 


the  error  between  the  system  output  and  the  model  output  by  using  error 
feedback.  No  computation  of  predictive  controls  is  done  and  no  reference 
trajectories  are  specified.  The  extensions  of  these  techniques  to 
nonlinear  systems  and  to  hierarchical  levels  of  control  are  much  more 
difficult  both  from  a  conceptual  and  an  algorithmic  viewpoint. 

Furthermore,  by  on-line  adaptation  of  the  internal  model  in  MRA  and  STR  the 
ability  to  detect  failures  is  lost.  The  Dynamic  Matrix  Control  approach  is 
conceptually  similar  to  MAC,  but  lacks  proper  use  of  reference  trajectories 
and  internal  models  which  are  especially  important  for  nonminimum  phase 
systems.  Similar  problems  exist  with  the  use  of  other  Inverse  Control  type 
of  methods  (Meyer  (1980)). 

4.2.3  Frequency  Domain  (Classic)  Methods.  There  are  few  methods 
known  to  us  which  are  capable  of  being  applied  successfully  to  the  ejection 
seat  control  problem.  The  work  of  Horowitz  (see  Horowitz  et  al ,  1980  for  a 
presentation  of  this  approach  and  support  literature)  seems  at  this  time  to 
offer  the  best  hope  as  an  alternative.  This  method  works  primarily  in  the 
frequency  domain  and  with  linear  representations,  but  combines  the  latter 
in  a  way  which  produces  an  LTI  equivalent  set  to  the  nonlinear  system  being 
approximated.  Elements  of  the  LTI  set  are  adjusted  by  compensation 
(primarily  forward  loop)  to  operate  within  specified  bounds  over  all 
variations  (of  up  to  several  orders  of  magnitude)  in  the  system  matrix 
elements.  The  equivalence  has  been  demonstrated  rigorously  using 
functional  analysis,  under  not  very  restrictive  assumptions  on  the  system. 
It  is,  then,  a  quantitative  nonlinear  technique,  which  does  directly 
address  the  "plant  ignorance"  problem.  It  is  thereby  claimed  to  be  very 
good  at  disturbance  rejection,  particularly  the  amplification  of  sensor 
noise. 

The  technique  is  now  briefly  described.  If  w  is  a  nonlinear  plant  or 
element,  an  LTT-equivalent  element  p  usually  exists  which,  for  a  specific 
input  x(t),  matches  the  (assumed  unique)  output  of  w,  y(t)  (y(t)  = 
w(t;x(t))).  p  can  be  found  via  the  inverse  Laplace  transform  of 
lY(s)/X(s)]  under  the  conditions  that  w  has  a  unique  inverse  (which 
excludes  direct  modeling  of  saturation  dynamics) ,  and  that  x  and  y  are 
Laplace  transformable.  An  LTI  set  P  equivalent  to  a  set  of  nonlinear 
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plants  W  with  respect  to  a  given  output  y  (t),  can  thus  be  generated.  By 
extension,  a  larger  set  P  can  then  be  found  which  is  equivalent  to  W  with 
respect  to  a  set  of  outputs  Y  (which  can  be  selected  to  bound  the  allowable 
response  region).  In  general,  the  sets  Y,  W  and  P  are  uncountable.  A 
finite  and  countable  subset  of  each  which  is  developed  from  the  system  per¬ 
formance  bounds  can  usually  be  developed.  The  approach  has  been  extended 
to  multivariable  systems. 

Adaptation  or  this  approach  to  the  ejection  seat  synthesis  problem 
would  require  great  care,  and  quite  possibly,  strenuous  effort  beyond 
available  resources.  The  need  to  look  at  all  combinations  of  extreme 
values  of  elements  of  A,  the  system  matrix,  could  lead  to  a  prohibitively 
high  number  of  cases  to  be  run  in  the  available  time.  In  addition,  more 
software  would  have  to  be  developed  or  obtained,  in  order  to  perform  this 
design  in  the  multidimensional  environment  of  the  ejection  seat  system. 
Because  the  approach  has  worked  with  nonlinear,  high  performance  aircraft 
systems,  and  possesses  adaptive  and  robustness  characteristics,  it  merits 
consideration. 

Another  approach  with  adaptive  features  and  flight  vehicle  control 
applications  has  been  proposed  by  Porter  (see,  e.g..  Porter  and  Bradshaw, 
1982).  The  approach  is  to  use  fast-sampling  error-actuated  digital 
adaptive  controllers.  It  is  claimed  that  the  controllers  are  simple  to 
implement  and  can  track  well  over  a  wide  flight  envelope. 

The  fast-sampling  feature  of  the  adaptive  controllers  is  necessary  to 
remove  major  restrictions  on  the  underlying  synthesis  technique  that  the 
model  be  LTI  and  rather  accurately  known.  In  addition,  singular 
perturbation  analysis  is  used  to  remove  a  restriction  to  "matchable” 
plants. 

The  control  law  generates  a  control  input  vector  u  which  causes  the 
output  vector  y  to  track  any  constant  (over  the  sampling  interval)  command 
input  vector  v  so  as  to  drive  the  difference  (v(k)  -  y(k))  to  zero,  as 
sample  time  k  goes  to  (tracking  condition).  The  singular  perturbation 
analysis  generates  specific  conditions  for  stability.  The  technique  uses  a 


PID  structure  for  loop  closure,  using,  as  we  do,  only  proportional  and 
integral  gains.  The  integrator  gain  is  related  to  the  proportional  gain 
via  a  positive  real  scalar,  and  the  proportional  gain  is  generated  in  real 
time  via  an  iterative  process.  It  is  shown  that,  as  sample  period  T  goes 
to  zero,  the  behavior  of  the  adaptive  system  asymptotically  approaches  that 
of  the  fixed  structure  discrete  time  tracking  system  at  the  asymptotic 
limit.  The  accuracy  of  the  system  is  thus  directly  and  proportionally 
related  to  the  controller  sample  frequency. 

This  approach  appears  to  have  the  necessary  features  required,  but  it 
is  unknown  at  this  time  if  what  it  offers  is  sufficient  for  ejection  seat 
applications.  Robustness  is  a  key  concern,  particularly  in  view  of  the 
short  duration  of  the  seat  control  activity,  vis-a-vis  the  asymptotic 
accuracy  requirement.  The  scheme  seems  to  be  very  easy  to  implement, 
however. 

There  are  other  promising  concepts  and  approaches,  all  covering 
multivariable  control  and  offering  robustness  and  sensitivity  reduction.  A 
technique  not  yet  well  enough  developed  for  this  project  but  a  very 
promising  one  for  eventual  investigation  is  the  stable  rational 
factorization  approach  developed  by  Youla,  Sain,  MacFarlane,  and 
M.  Vidyasagar.  The  latter  is  a  consultant  to  SSI.  Multivariable 
performance  and  robustness  analysis  for  systems  with  structural  uncertainty 
is  also  dealt  with  in  a  series  of  papers  by  Doyle  and  Stein  (see  in 
particular  Doyle  and  Stein  (1981)  and  Doyle  et  al  (1982)).  This  theory,  if 
implemented,  may  offer  a  way  to  accomodate  the  serious  objection  to  optimal 
and  even  adaptive  methods  that  they  require  accurate  models.  The  main 
drawback  to  all  of  the  above  approaches  for  ejection  seat  application  are 
assumptions  of  linear  or  linearizable  dynamics. 

4.2.4  Computation  of  Optimal  Trajectories  Using  ESOP  (Escape  System 


Optimization  Program) .  This  large  scale  nonlinear  programming  code  has 
been  developed  at  Stanford  University  by  Murtaugh  and  Saunders  (1981)  and 
has  been  used  by  SSI  for  solving  optimization  problems  with  over  2000 
constraints.  We  also  used  this  code  for  obtaining  optimal  thrust  vector 
profiles  for  the  ejection  seat  to  keep  all  the  Flight  and  human  tolerance^ 
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constraints  satisfied.  We  give  a  brief  description  of  the  algorithm  in 
this  section. 


The  approach  in  using  ESOP  is  to  consider  a  general  optimization 
problem,  where  the  nonlinearity  is  separated  from  the  linear  part  in  the 
following  form-' 


Minimize  F(x)  +  c  x  d  y 


(4.8) 


Such  that 


g(x)  +  Ajy  =  bi 


(4.9) 


A2X  -t-  A3y  =■  b2 
t  <i  X  <  u 

_y_ 


(4.10) 


where  x,  y,  i,  u,  d,  b]  and  b2  are  vectors  and  A^ ,  A2 ,  A3  are  matrices  of 
consistent  dimensions.  F(:0  is  a  scalar  function  and  g(x)  is  a  vector 
valued  nonlinear  function.  The  vector  (  x,  y  )  in  (4.10)  represents  all 
state  and  control  variables  over  the  flight  trajectory  at  discrete  time 
points.  That  is,  x  is  the  string  [xo(to)»  xj(ti),...,  XN(tN)]. 

The  solution  technique  consists  of  solving  a  sequence  of  linearly 
constrained  snbprobl ems  ("major  iterations”).  At  the  start  of  each 
iteration,  the  nonlinear  constraints  are  linearized  and  the  objective 
fum.tiun  is  modified,  actaallv  augmented  with  a  penalty  term  to  prevent 
large  excursion  of  variables  from  the  current  point.  The  subproblem  is 
then : 


Minimize  F(x)  +  c  x  +  d  y  -  A  T(g-g^)  +  P  {g-gk)T(g_g^) 
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where  g  (x)  is  the  linear  approximation  to  g(x)  at  x  : 


gk(x)  =  +  Jk  -  ’'k) 

=  Jacobian  of  g(x)  with  respect  to  x  at  X]^. 

is  a  multiplier  vector  corresponding  to  the  nonlinear  constraints 
g(x)  and  the  scalar  p  is  positive. 

The  above  subproblem  is  linearly  constrained  with  a  nonlinear 
objective  function.  A  particular  version  of  the  Generalized  Reduced 
Gradient  method  is  then  developed  which,  for  the  sake  of  notational 
simplicity,  is  formulated  in  terms  of  the  following  optimization  problem 

Minimize  F(x)  +  c  x  F  :  nonlinear,  x,  ce 

s.t.  Ax  =  b  A  :  mxn,  x,  b  e  R*’ 

<  X  <  u 

The  matrix  A  is  divided  in  three  blocks  corresponding  to: 

A  =  [B  S  N] 

The  mxm  matrix  B  corresponds  to  basic  variables,  as  in  the  simplex  method 
The  basic  variables  take  values  anywhere  between  the  lower  and  upper 
bounds.  The  n-m  remaining  variables  are  divided  into  nonbaslc  (N)  and 
superbasic  (S)  variables.  The  nonbasic  variables  are  always  equal  to  one 
of  their  bounds,  but  the  superbasic  variables  can  take  values  within  the! 
bounds.  The  basic  and  nonbasic  variables  are  eliminated  and  the  problem 
reduced  to  the  optimization  over  superbasic  variables  only.  Tn  terms  of 
the  matrix  7. ,  the  choice  is: 


1 


-I 

-B  si  m 


0  I  n-Og-m 


The  reduced  gradient  is  then  computed  as 

=  zT7F(x) 

and  the  optimization  is  done  over  Og  superbasic  variables.  Once  it  appears 
that  no  improvement  can  be  achieved  with  the  current  set  of  superbasic 
variables,  one  or  more  basic  variables  are  selected  to  become  superbasic 
and  the  minimization  is  done  with  respect  to  the  new  set. 

For  large  scale  sparse  problems,  sparsity  techniques  are  used  both  in 

constructing  the  matrix  Z,  and  in  bypassing  the  computation  of  * 
apply  to  the  ejection  seat  trajectory  optimization  problem,  the  following 

steps  are  taken: 

(i)  The  ejection  seat  trajectory  is  divided  into  various  segments  and 
equations  of  motion  and  constraints  are  specified  as  in  Section  3.2. 

(ii)  The  equations  of  motion  are  discretized  based  on  the  bandwidth  of 
control  actuators  which  determine  the  rates  at  which  the  magnitude  and 
direction  of  thrust  vector  can  be  changed. 

(iii)  A  performance  index  based  on  minimization  of  the  radical  over 
the  flight  trajectory  is  specified. 

(iv)  The  equations  from  steps  (ii)  and  (iii)  are  expressed  in  the  form 
of  Equations  (4.8  to  4.10).  Notice  that  vectors  x  and  y  consist  of  both 
the  state  and  the  control  variables  over  the  trajectory  and  are,  therefore, 
of  a  fairly  high  dimension.  For  example,  if  a  discretization  step  of  0.01 
sec.  is  used,  then  during  the  rocket  burning  phase  of  approximately  0.3 
sec.,  there  will  be  30  values  for  all  the  states  and  controls,  which  would 
typically  result  in  a  vector  [x,y]  of  dimension  around  900.  Since  ESOP  is 
capable  of  handling  such  vectors  of  dimension  4000  to  5000,  this  would  not 
cause  any  difficulty.  Notice  that  ESOP  allows  for  very  general  constraint 
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and  performance  index  specification  (cf.  Equations  4.8  to  4.10))  and 
exploits  effectively  the  sparsity  in  these  constraints.  Since  in  an 
optimal  control  problem,  the  equality  constraints  come  from  a  set  of 
differential  equations,  the  constraints  (4.9)  will  have  a  triangular 
structure. 

ESOP  can  be  used  for  a  number  of  ejection  conditions  to  cover  the 
complete  flight  envelope.  The  real-time,  suboptimal,  method  of  generating 
reference  accelerations  continues  to  offer  much  promise  as  a  reliable 
scheme,  in  view  of  the  excellent  robustness  of  the  basic  design. 

4.2.5  Other  Related  Programs  (MPES). 

Investigation  into  onboard,  feedback  controllers  for  escape  systems  did 
not  originate  with  this  project.  In  the  late  1970' s,  the  Naval  Air  Systems 
Command  initiated  a  program  at  the  Naval  Air  Development  Center  to  improve 
aircrew  escape  safety  and  survivability  (Arrone  et  al,  1981).  This  program 
developed  the  Maximum  Performance  Ejection  Seat  concept,  which  demonstrated 
advances  in  propulsion  control,  pilot  restraint  technology,  survival  equip¬ 
ment,  and  maintainability  (Stone  and  Bishop,  1980).  The  baseline  system 
was  the  Martin-Baker  GRU-7A  ejection  seat  and  its  operation  within  the 
F-14A  aircraft.  The  program  was  contracted  to  Grumman  Aerospace 
Corporation,  Bethpage,  NY. 

One  of  the  key  technologies  related  to  automatic  control  of  the  seat 
involved  design  and  test  of  a  vertical  seeking  capability.  Incorporating 
the  vertical  seeking  technology  into  the  GRU-7A  seat  required  design  of  a 
vectored  thrust  control  system  which  could  utilize  the  vertical  seeking 
function  for  the  critically  needed  attitude  reference.  Upgrading  current 
systems  with  such  a’system  offers  dramatic  improvements  in  minimum  altitude 
performance  capabilities. 

The  project  which  is  the  subject  of  this  report  represents  an  extension 
of  the  MPES  technology  primarily  in  that  mult 1-nozzled ,  thrust  modulation 
propulsion  systems  are  utilized  in  the  design.  By  doing  so,  a  fully 
integrated,  comprehensive  attitude  and  trajectory  control  scheme  can  be 
mechanized.  The  MPES  program  considered  single  and  twin  rocket  systems. 
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but  these  have  restricted  flexibility  in  full  6  DOF  applications.  See 
Section  3.2.2  for  further  details  on  single  vs.  multiple  nozzle  con¬ 
figurations.  See  also  Chapter  5  for  a  components  trade  analysis  of  the 
micrad  altitude  sensor,  which  was  utilized  in  MPES  as  the  verticle  seeking 
sensor. 

4.3  Acceleration  Control. 

This  section  presents  a  detailed  description  of  the  control  concept 
selected  for  the  vectored  thrust  digital  control  law  design  for  ejection 
seats.  It  is  a  nonlinear,  predictive,  multivariable  scheme  which  relies 
heavily  on  translation  and  rotation  accelerations,  both  for  the  quick 
response  properties  and  because  of  the  acceleration  constraints  (e.g.,  the 
acceleration  radical)  which  are  peculiar  to  the  ejection  seat  problem. 


4.3.1  Evolution  of  Design 

The  unique  control  requirements  imposed  by  the  crew  escape  mission 
require  a  control  structure  uniquely  suited  to  implement  these  require¬ 
ments.  After  careful  analysis,  we  have  chosen  a  predictive,  nonlinear, 
multivariable  scheme  which  we  shall  in  this  report  call  "acceleration 
control".  This  approach  follows  closely  the  work  of  Meyer  and  Cicolani 
(1975),  although  certain  modifications  specific  to  ejection  seat  control 
applications  have  been  implemented.  The  discussion  in  this  section  follows 
that  of  the  above  reference.  This  section  presents  the  rationale  behind 
the  selection  of  the  acceleration  control  approach,  and  describes  the  modi¬ 
fications  made  for  ejection  seats. 

Earlier  sections  have  examined  the  basic  control  requirements  and 
other  control  approaches,  and  have  presented  their  various  shortcomings  for 
this  application.  Acceleration  control  has  been  selected  for  this  problem 
because  its  shortcomings  are  fewer  by  comparison  with  the  other  approaches. 

Acceleration  control  works  directly  with  nonlinear,  multivariable 


models.  As  we  shall  show,  it  can  be  made  to  work  in  rapid  response 
situations  in  real  time,  especially  when  the  design  is  hierarchical,  and 
can  adjust  properly  for  a  broad  spectrum  of  escape  conditions. 


“ '  I--  -.-  rj.  - J,  - 


Due  to  the  recent  technological  explosion  in  practical  sensing  devices 
and  computational  capacity,  the  designer  is  limited  now  primarily  by  the 
available  methodology  for  the  design  of  automatic  flight  control  systems, 
and  by  the  propulsion  system  hardware.  The  latter  limitation  is  not  a 
direct  focus  of  this  report,  although  we  recognize  its  critical  role  in  the 
overall  control  design  effort. 

In  the  area  of  control  design  methodology,  the  most  severe  limitation 
of  most  existing  design  techniques  is  their  extreme  reliance  on  linear 
perturbation  models  of  the  physical  plant  being  controlled.  Such  models 
are  usually  a  key  to  whatever  control  design  process  is  used.  We  have 
demonstrated  in  this  report  the  high  degree  of  nonlinearity  which  is  a 
feature  of  the  dynamics  of  open  ejection  seats.  For  schemes  dependent  on 
linearization,  a  highly  nonlinear  plant  leads  to  the  requirement  for  many 
perturbation  models  to  cover  the  flight  envelope  adequately.  Logic  then 
must  be  provided  in  the  flight  computer  for  switching  the  perturbation 
control  gains  and  reference  controls  as  the  seat  leaves  the  domain  of 
validity  of  one  perturbation  and  enters  another.  The  result  would  be  a 
design  that  is  complex  both  in  concept  and  implementation  so  that  analyses 
of  closed-loop  sensitivity  to  modeling  errors  and  subsystem  failures  are 
exceedingly  difficult  and  not  very  convincing. 

Design  techniques  are  needed  of  sufficient  generality  to  be  applicable 
to  a  large  set  of  escape  conditions  with  nonlinear  dynamics  and  multiple 
controls.  The  techniques  must  be  nearly  algorithmic  to  allow  for  ready 
adaptation  to  many  alternative  configurations  early  in  the  design  cycle. 

Of  great  importance,  these  techniques  must  result  in  designs  sufficiently 
simple  to  achieve  the  critical  reliability  requirements  for  operational 
escape  systems, 

4.3.2  Features  of  the  Final  Design 

The  acceleration  control  concept  is  responsive  to  the  above 
requirements.  The  proposed  logic  structure  for  the  controller  (Fig.  4.3) 
consists  of  four  major  subsystems:  (1)  translational  acceleration  control; 
(2)  attitude  control  via  tracking  of  angular  acceleration  trajectories; 
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(3)  trajectory  perturbation  controller  which  closes  the  loop  around  the 
Inaccuracies  of  the  tracking  control  activities.  The  result  Is  a 
trajectory  acceleration  controller  whose  Input— output  relation  between 
commanded  and  actual  acceleration  is  essentialy  an  identity — provided  the 
input  is  flyable  and  its  bandwidth  is  suitably  restricted;  (4)  the 
trajectory  command  generator  develops  translational  and  rotational 
accelerations  which  are  consistent  with  the  capabilities  of  the  overall 
system  ("achievable"  commands). 

The  basic  input  to  the  control  logic  is  the  trajectory  to  be  followed 
by  the  seat,  from  the  time  of  complete  departure  from  the  cockpit  of  the 
stricken  aircraft.  Prior  to  this  time,  the  seat  has  been  moving  up 
guiderails  inside  the  aircraft,  accelerated  by  a  catapult  device.  During 
this  period,  which  lasts  approximately  120  to  150  milliseconds,  the  control 
system  should  be  in  operation,  turning  on  sensors,  determining  the  escape 
condition  (speed,  altitude,  attitude),  positioning  the  sustainer  rocket 
system's  control  effectors,  deciding  on  reliability  of  data  from  the 
aircraft  aironics  systems,  selecting  parameters  and  (if  needed)  reference 
trajectories  appropriate  to  the  escape  condition;  and  conducting  self¬ 
examinations  (e.g.,  built  in  test  and  evaluation  —  BITE)  of  its  sub¬ 
systems. 


Proportional  plus  integral  control  in  the  error  control  loop  provides 
velocity  and  acceleration  vectors  to  the  control  logic  continuously. 
Moreover,  since  ultimately  the  seat's  motion  is  in  inertial  space  (for  this 
problem,  a  flat  nonrotating  earth  is  an  adequate  inertial  reference), 
inertial  vector  quantities  are  considered  as  fundamental.  As  stated  above, 
it  is  important  that  the  control  logic  contains  a  trajectory  command 
generator  that  synthesizes  "flyable"  trajectories  —  that  is,  trajectories 
amenable  to  the  capabilities  and  limitations  of  the  full  control  system. 

Because  tracking  accuracy  in  the  usual  sense  is  not  a  tight 
requirement  for  crew  escape,  beyond  achieving  attitudes  for  crewperson 
survival  and  minimum  discomfort/injury,  a  relatively  simple  seat/pilot 
model  may  be  used.  Increasing  accuracy  requirements  usually  adds 
complexity  to  the  control  logic,  and  with  it  extra  computer  operations  in 
the  duty  cycle. 


The  sustainer  rocket  configuration  provides  the  thrust  vectoring 
capability  needed  to  track  the  reference  trajectories.  Vectored  thrust 
refers  both  to  magnitude  and  direction  changes  in  the  resultant  rocket 
thrust  brought  about  by  active  control  commands.  Our  control  logic  design 
and  analysis  quite  naturally  points  to  the  need  for  a  flexible, 
fast-reacting  configuration.  The  preferred  means  of  realizing  this  appears 
to  be  to  locate  several  nozzles  at  the  seat  extremities  for  attitude  or 
"vernier"  control,  and  retain  a  larger,  main  thruster  roughly  where  current 
rockets  now  are. 

The  "trim  problem"  refers  to  the  "inverse"  operation  of  converting 
the  control  logic  output  -  rocket  force  and  torque  commands  -  into  throttle 
levels,  gimbal  angles,  valve  settings,  etc.,  of  each  nozzle  control  device. 
Each  quantity  is  an  element  of  the  control  vector.  A  complication  to  the 
trim  problem  arises  when  the  actuator  configuration  admits  redundant 
control.  The  trim  problem  is  said  to  be  overdetermined.  This  happens  when 
the  dimension  of  the  full  control  vector  exceeds  six,  which  is  the  number 
of  force  and  torque  vector  components  to  be  realized.  The  "trimmap"  is  the 
section  of  the  control  logic  in  which  the  control  redundancy  is  resolved 
and  commands  are  generated  continuously.  In  practise,  for  overdeterrained 
problems  this  logic  typically  involves  introduction  of  constraint  and 
optimization  criteria  to  generate  a  unique  command. 

When  the  trim  logic  is  adequately  constructed,  it  provides  a  priori 
open  loop  information  to  the  full  control  system,  relative  to  performance 
limitations.  Ideally,  this  reduces  the  role  of  the  perturbation  controller 
to  control  of  uncertainties  in  the  dynamic  model  or  environment.  Thus, 
there  is  again  a  tradeoff  between  accuracy  of  performance  and  logic 
complexity  (e.g.,  detail  of  models). 

During  the  course  of  this  project,  we  have  analyzed  two  major  thrust 
actuation  configurations.  One,  developed  at  SSI,  consists  of  a  main 
thruster  and  two  verniers  with  full  vectoring  capability.  The  main 
thruster  gimbals  in  pitch  only.  This  configuration  is  "generic"  in  the 
sense  that  its  primary  purpose  is  to  allow  study  of  the  interaction  of  the 
control  logic  outputs  with  dynamic  control  elements,  in  order  to  quantify 
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performance  requirements  of  the  latter.  Less  attention  has  been  given  to 
possible  unrealistic  or  harmful  gimbal  orientations  which  may  arise  in 
certain  situations.  See  Section  3. 2. 2. 3. 

The  second  design,  proposed  by  Martin  Marietta  (Section  3. 2. 2. 4), 
is  more  realistic,  consisting  of  a  total  of  seven  nozzles,  three  pairs  of 
which  are  primarily  dedicated  to  attitude  control.  Considerations  of  a 
proprietary  nature  prohibit  us  from  explaining  this  concept  in  detail. 
However,  the  purpose  for  analyzing  this  configuration  was  primarily  to 
investigate  the  effect  of  a  more  realistic  configuration  on  the  structure 
of  the  control  logic. 

The  perturbation  controller  acts  in  a  closed  loop  manner  to  eliminate 
acceleration  and  velocity  departure,  from  the  reference  generated 
trajectories.  This  amounts  to  feedback  control  over  details  of  the  physical 
process  that  are  not  accounted  for  in  the  open  loop,  feedforward  trim 
control  either  because  they  are  unknown  or  because  adding  them  would 
unnecessarily  complicate  the  open  loop  control.  Consider  a  nonlinear 
system  governed  by  the  vector  equation 

X  =  f(x,u)  (4.12) 

where  x  is  the  n-dimensional  state  vector  and  u  is  the  m-dimensional 
control  vector.  In  addition  consider  that  u  is  restricted  to  a  set  U  which 
could  depend  on  x,  but  more  typically  is  defined  primarily  by  the  rocket 
configuration  and  thrust  capability  of  the  rocket.  A  trajectory 
[xo(t),teT]  is  achievable  if,  for  all  teT  ,  where  T  defines  the  time  period 
during  whicn  the  sustainer  rocket  are  ignited,  there  is  a  control  Uo(t)eU 
such  that 

Xo(t)  =  f [xo(t) ,Uo(t))  (4.13) 

The  trim  problem  is  defined  in  terras  of  equation  (2)  as  that  of  finding 
a  control  Uq  satisfying  (4.13),  given  that  the  trim  (nominal)  trajectory 
XQ(t)  is  achievable.  The  solution  is  the  inverse  of  the  state  equation 
namely  the  trimmap  (g,E),  so  that  for  all  (x,x)  in  the  escape  envelope  E, 


The  corresponding  trim  control  is 


Uq  =  SCXo.Xq) 

Trim  usually  referes  to  fixed  Uq,  which  is  allowable  subset  of  controls 
for  the  crew  escape  problem  also.  However,  the  concept  is  generalized  here 
to  include  time-varying  open  loop  controls.  As  noted  above,  when  controls 
are  redundant,  that  is,  m  >  6,  equation  (4.12)  alone  does  not  define  the 
trimmap  (g,E),  and  additional  conditions  (eg.  cost  criteria)  must  be  intro¬ 
duced. 

After  the  trim  problem  is  solved,  the  next  step  has  usually  been  to 
design  feedback  control  systems  based  on  perturbation  models  derived  from 
equation  (4.12).  Methods  of  linear  and  optimal  control  theory  produce  a 
perturbation  control  law 

®u  “  Kq^X 

where  the  matrix  gain  Kq  is  appropriate  to  the  reference  trajectory. 
Complete  coverage  of  the  escape  envelope  E  requires  offline  development  of 
a  scheduled  gain  matrix  K(Xq,Xq),  resulting  in  the  complete  control  law 

U  =  g(Xo.Xo)  +  K(Xo,Xo)(x-Xo) 

The  structure  such  a  controller  is  depicted  in  Figure  4.6.  The  above 
LQ-type  process  (this  is  how  K  is  usually  derived)  has  appreciable  dif¬ 
ficulty  when  the  system  (4.12)  is  very  nonlinear.  The  procedure  for 
choosing  the  proper  set  lxo^,Xo^)}fj  of  nominal  trajectories  to  cover  ade¬ 
quately  the  envelope  E  and  switch  among  perturbation  models  is  for  now 
rather  unclear.  In  addition,  LQ  methods  require  extra  complexity  even  to 
deal  approximately  with  state  and  control  constraints.  For  the  crew  escape 
problem  in  particular,  this  is  a  serious  limitation.  Excessive  nonli¬ 
nearity  may  force  the  perturbation  trajectory  outside  the  envelope, 
from  a  nominal  XoEE.  If  envelop  limiting  is  achieved  by  limits  6U  on  6u, 
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Figure  4.6.  Selected  structure  in  conventional  design. 

The  nonlinear  function  g(xQ,  xq)  is  the  trim  control  function,  generating 
trim  control  uq.  Latter  is  augmented  by  LQ  feedback  correction  control, 
du,  to  produce  complete  control,  u.  State  variable  rates  of  change  x  are  a 
function  of  f(x,  u),  the  system  nonlinear  model,  plus  disturbances,  e.  x 
is  integrated  to  obtain  x,  which  is  compared  to  nominal  x. 


u) 


Figure  4.7,  Stucture  of  proposed  perturbation  controller. 

By  passing  feedback  (error)  signals  through  the  trim  logic,  effects  of 
uncertainties  are  controlled  better.  See  accompanying  text. 


Lht'n  quesLions  concerning  the  stability  of  the  resulting  nonlinear  pertur¬ 
bation  controller  must  be  resolved  for  each  of  the  N  perturbation  models. 
Since  these  limits  on  6u  are  likely  to  depend  on  (xq,Xq),  6U(Xq,Xq)  must  be 
stored  in  the  control  logic  in  addition  to  K(xq,Xq)  and  the  trimmap 
gCxQ.Xg).  Also,  the  dynamics  of  switching  from  one  case  to  the  next  must 

be  designed,  including  some  accounting  for  the  possibility  of  using 
hysteresis  to  prevent  chatter  if  the  seat  is  to  fly  along  a  boundary  bet¬ 
ween  two  models.  Switching  logic  and  dynamics  add  further  to  com- 
putat Lonal  burden  and  complexity.  Finally,  there  are  reliability  issues. 

Is  stability  maintained  when  a  column  (sensor)  or  a  row  (control)  of  K  is 
lost? 

Such  questions  are  difficult  to  deal  with  in  the  framework  of  modern 
control  or  the  LO  approach.  Older  classical  techniques  based  on  sequential 
loop  closures  that  result  in  a  nesting  (hierarchy)  of  subsystems  with 
decreasing  bandwidth  are  more  effective  for  designing  fail-safe  (robust) 
systems.  The  acceleration  control  concept  presented  here  has  these 
features,  and  in  addition  is  much  less  effected  by  the  nonlinearity  of 
equation  (4.12)  or  by  state  and  dynamic  constraints.  See  also  Section 
4.2.1  . 

In  contrast  to  the  standard  design  approach  exemplified  in  Figure  4.6, 
the  acceleration  control  structure  for  the  automatic  flight  control  system 
consists  of  feedback  achieved  through  the  automatic  trim  logic.  This  is 
seen  in  Figure  4.7.  Here,  the  feedback  is  through  the  perturbation  6X0 
on  the  (nominal)  trim  condition  Xq.  The  open  loop  reference  trajec¬ 

tory  accelerations  generate  an  open  loop  control  u  which  is  capable  of 
maintaining  x  =  x^,  if:  (1)  initially,  x  =  Xq;  (2)  the  trajectory  is 
feasible,  and  (3)  there  are  no  systems  modeling  errors. 

In  these  conditions  are  met,  the  tracking  will  be  perfect,  even  in  the 
presence  of  nonzero  6x0  (which  arises  from  distribances ,  or  process  noise), 
as  long  as  (Xf,  +  6xq)  falls  within  E,  the  achievable  escape  region.  The 
control 


=  g(Xo  +  '^Xq.x) 


then  takes  x(t)  into  XgCt),  that  is,  the  feedback  for  controlling  process 
uncertainties  is  closed  through  the  automatic  trim  logic  (assuming  feas- 
bility)  Figure  4.7,  rather  than  after  the  trim  logic.  Figure  4.6,  the  LQ 
approach. 

The  structure  allows  for  envelope  limiting  and  use  of  dynamic 
constraints  within  the  trimmap.  Admissable  perturbations  6xq  are  directly 
handled  by  this  structure.  Thus,  the  emphasis  is  shifted  from  the  several 
linear  perturbations  models  required  to  cover  E  to  the  construction  of 
achievable  perturbations  in  the  commanded  trajectories.  When  emphasis  is 
made  of  hierarchical  design,  this  latter  task  is  simplified. 

We  note  here  that  the  envelope  limiting  within  the  trimmap,  predictive 
control  based  on  reference  trajectories,  use  of  the  plant  model  in  the 
control  logic  and  incorporating  explicit  limiting  within  the  control  logic 
(trimmap)  are  also  features  of  Model  Algorithmic  Control  (Section 
4.2.2).  The  hierarchy  consists  of  slower  varying  (command)  processes  at 
higher  levels,  and  fast-reacting  processes  at  lower  levels.  The  hierarchi¬ 
cal  structure  for  the  crew  escape  control  logic  is  centered  on  the  rota¬ 
tional  and  translational  acceleration  controllers.  In  more  common  systems, 
e.g.,  the  VSTOL  controller  discussed  in  Meyer  and  Cicolani  (1975),  the 
attitude  controller  is  at  a  lower  (faster)  level  than  the  translational 
acceleration  controller.  We  don't  allow  the  "luxury”  of  separate  levels 
for  attitude  and  translation  in  the  crew  escape  problem,  because  in  many 
scenarios  there  is  no  time  to  allow  for  attitude  transients  to  grow  suf¬ 
ficiently  small  before  issuing  acceleration  commands. 

The  ejection  seat  acceleration  controller,  then,  solves  simultaneously 
the  6  DOF  attitude  and  trajectory  problem.  This  is  done  by  accepting  com¬ 
mands  from  the  command  generator,  at  one  level  higher,  which  produces,  in 
real  time,  w^,(t).  They  are  sent  as  commands  to  throttle  and 

nozxle  aciiators,  which  are  one  level  lower.  From  the  controller  level, 
acuator  models  may  be  relatively  simple  input-output  relations,  which  are 
treated  as  specifications  to  be  met  in  the  design  of  these  subsystems.  The 
overall  design  can  proceed  one  level  at  a  time,  at  each  level  assuming 
acceptable  inputs  from  the  other  levels.  Sensor  dynamics  are  treated  simi- 


larly,  and  are  also  one  level  below  the  acceleration  controller.  The  trim- 
map  is  the  major  logic  activity  of  the  acceleration  controller.  The 
inertial  coordinates  of  the  acceleration  commands  (a(.,I)j,)  are  converted  by 
the  acceleration  control  logic  first,  to  force  and  torque  commands 
(frcjtrc)  to  be  realized  by  the  propulsion  system,  In  seat/pilot  (Body) 
coordinates;  and  secondly,  to  commanded  thrust  levels  and  (where 
appropriate)  nozzle  girabal  angles  or  value  settings-the  elements  of  u.  The 
realized  acceleration,  (a,il))  compares  to  the  command  (a(.,(!oj.)  to  within  the 
inaccuracies  of  the  trimmap.  Much  of  these  relate  to  the  detail  of  the 
model  used  in  the  controller.  While  there  is  no  inherent,  structured  limit 
to  be  associated  with  the  detail,  or  complexity,  of  this  model-  as,  for 
example,  the  requirement  that  it  he  linear  -  it  is  typically  wisest  to  use 
as  simple  a  model  as  possible  which  produces  adequate  performance. 

The  discrepancies  between  commanded  and  actual  accelerations  are 
resolved  by  the  perturbation  controller.  Inertial  acceleration  and  velo¬ 
city  errors  are  weighted  by  the  constants  K1 ,  K2,  K3 ,  and  K4  to  generate 
commands  commensurate  with  the  rocket  acceleration  capabilities; 

dfr  =  m[Kj(a(j  -  a)  +  ~ 

dtr  =  l[K3(Wd  -  W)  +  K4(Wd  -  W) 1 

Note  that  the  combination  of  acceleration  and  velocity  error  signals  is 
equivalent  to  processing  acceleration  errors  through  a  proportional-plus- 
integral  feedforward  filter.  This  type  of  compensator  in  closed  loop  error 
control  is  commonly  and  successfully  used  for  steady  state  error  control. 

The  trajectory  command  generator  must  provide  admissible  acceleration 
commands  to  the  acceleration  controller.  Tn  the  hierarchy  of  the  central 
logic  the  command  generator  is  one  level  above  the  acceleration  controller. 
The  set  of  admissible  (inertial)  commands  of  total  seat/pilot  CG  and  rota¬ 
tional  accelerations  have  been  arrived  at  by  several  schemes  in  our  work. 
For  example,  attittide  command. ’d  accelerations  have  been  supplied  by  off¬ 
line  optimal  programs  (see  4.2.4),  cross  product  steering,  and  Euler 
steering.  By  setting  up  a  general  structure,  as  we  have  done,  other 
variations  within  the  three  classes  can  be  achieved  by  zeroing  a  parameter. 


And  there  are  certainly  other  schemes  not  tried  in  our  current  work 
which  should  also  do  very  well. 

4. 3. 2. 3  Details;  Summary  Considerations  of  reliability  and  simplicity 
motivated  the  decision  to  use  hierarchical  acceleration  control.  The 
control  logic  works  simultaneously  on  the  six  rigid  body  degrees  of 
freedom.  Process  uncertainties  are  controlled  by  means  of  a  perturbation 
controller  which  closes  the  loop  around  the  acceleration  controller  and  the 
control  select  (trimmap)  logic.  The  design  and  implementation  of  the  per¬ 
turbation  controller  are  greatly  simplified  by  the  decision  to  close  the 
feedback  through  the  trimmap. 

The  idea  is  an  acceleration  controller  whose  input-output  relationship 
is  approximately  an  identity  everywhere  within  tVie  escape  envelope  (E)  for 
suitably  restricted  acceleration  commands.  The  function  of  the  command 
generator  is  to  give  only  admissible  commands  to  the  accelerator  controller 

A  specific  seat  rocket  configuration  geometry,  part  of  the  A  DOF 
simulation  model,  converts  the  control  vector  into  seat-referenced 
rocket  forces  and  torques  via  the  relationship 

R 

=  B(uc)  (4.14 

R- 

where  B  is  a  (6  x  1)  vector  and  fg  and  Tg  are  the  3-dimensional  forces  and 
torques  due  to  rocket  thrust. 

The  control  design  presented  in  this  report  answers  affirmatively  the 
concerns  about  overall  feasibility  of  self-contained,  active  control  of  an 
ejection  seat,  using  state-  or  near-state-of-the-art  hardware.  The 
complexity  of  the  controller  is  flexible,  from  being  able  to  handle  the 
highly  constrained  high-Q  ejections  by  utilizing  increased  energy  source 


and  microprocessor  capability,  to  reliance  on  very  simple  control 
strategies  where  physiological  limits  are  not  threatened,  to  shaping 


solution  is  much  simpler,  and  not  necessarily  "optimal",  since  safe  egress 
can  be  effected  by  any  number  of  trajectories.  For  such  ejections  low 
speed,  near  nominal  attitude,  rocket  thrust  Is  reduced  but  fixed,  and 
attitude  is  set  for  safe  main  chute  deployment. 

Currently,  seat  dynamics  are  being  generated  by  a  6  DOF  simulator. 

For  this  function,  we  are  now  using,  as  appropriate,  one  of  four  basic 
simulation  systems:  EASIEST  (West,  Ummel  and  Uyrczyk,  1980),  SAFEST 
(Jines,  1982),  plus  our  own  specialized  6  DOF  program,  THIST,  developed 
specifically  for  generalized  control  synthesis  of  the  type  required  for 
this  project.  THIST  and  its  support  software  are  described  in  Appendix  C. 
The  fourth  simulation  system  is,  of  course,  the  real  time  hybrid  system 
which  uses  the  breadboard  controller  (Volume  II,  Chapter  6). 

Referring  to  Figure  4.5,  the  6  DOF  simulator  (which  now  has  the  role 
of  the  physical  plant,  the  ejection  seat)  generates  the  plant  output  vector 
X,  the  system  or  state  variables.  We  are  using  the  12th  order  set 

X  =  (u,v,w,p,q,r,<J),0,X{;,yE,ZE,i|;)  (4.15 

where  notation  follows  standard  aeronautical  usage,  except  that  xg,  y^  and 
Zj.  are  position  components  in  the  reference  inertial  (local  horizontal) 
frame.  The  linear  and  angular  velocity  variables  are  inertial  quantities, 
but  coordinalized  in  body-fixed  areas. 

Components  of  the  state  vector  x  are  sensed  or  estimated  on  board  in 
real  time,  as  the  vector  x.  In  order  to  have  available  the  appropriate 
quantites  for  the  controller,  such  as  local  vertical,  it  is  necessary  that 
the  seat  have  on-board  rate  gyros  and  accelerometers  for  all  three  axes. 

For  the  remainder  of  this  chapter,  we  shall  use  elements  of  x  and  x 
interchangeably,  the  assumption  being  that  we  are  specifically  referring  to 
the  measured  elements  x. 

The  internal  model  block  of  Figure  4.5  solves  the  following  set  of 
equations  for  Tg  and  fg 


V  +  wxv 


~  ( f g  +  fg  +  f|-)/m 


(4.  Ifi 


la)  +  a)x(Ia))  “  ig  +  Tj. 


(4.17 


The  elements  of  x  needed  for  these  computations  are  o)  =  (p,-.  r) ,  6,  <(), 
(for  fg,  gravity  force),  u,  v  and  w  (for  fg  and  Tg,  aero  force  and  torque), 
and  a  =  (u,  v,  w) .  To  these  computed  rocket  forces  and  torques  must  be 
added  correction  forces  and  torques  of  the  form: 

Af  =  m[ki(a4  -  a)  +  k2(v,j  -  v)l  (4. If 

Atr  =  l[k3(a)d  -(!))+  k4(a)jj  -  o))]  (4.19] 

In  equations  (4.18)  and  (4.19),  a^j,  o)^,  vj  and  (dj  are  the  reference,  or  the 
desired  translational  and  rotational  accelerations  and  their  integrals, 
respectively.  These  quantities  are  obtained  either  from  the  prestored 
files,  generated  off-line  for  a  similar  case,  or  from  real-time,  suboptimal 
logic,  such  as  cross  product  steering  logic. 

We  are  currently  obtaining  success  implementing  Equations  (4.18)  and 
(4.19).  More  generally,  the  Av  =  (v^j-v)  and  Ao)  terms  come  from  the 
integral  feedforward  compensator,  e.g.. 


Aa  =  (kj  +  _2)Aa(s) 


(4.20 


The  measurement/estimation  process  typically  has  an  implied  integration,  so 
there  is  no  loss  of  generality  in  this  regard. 


The  required  forces  and  torques  for  the  next  cycle  are  then  given  by 


fr(t)  =  fr(t;-l)  +  Afr(t)  (4.21! 

Tr(t)  =  Tr(t-l)  +  ATi.(t)  (4.22 

where  fi.(t-l)  and  Tj.(t-1)  are  found  from  Equations  (4.16)  and  (4.17).  The 
actuator  controller  mechanizes  the  specific  configuration  geometry  -  that 
is,  the  current  rocket  and  force  commands  are  converted  into  thrust 
magnitudes  and  nozzle  deflection  angles.  Another  loop  around  this 
controller  represents  "actuator"  dynamics  for  the  propulsion  system. 


Algorithmically,  Equations  (4.21)  and  (4.22)  are  implemented  as 


follows : 


where 


^r  B  r  ^ro 

=  M[Ax  +  (“)ul  + 


(4.23) 


I  03x3  I 

(4.24) 


03x3  I 


and  fro>  ^tq  represent  zero-deflection,  nominal  thrust  forces  and  torques. 
In  our  algorithm,  Tro  -  0  for  a  50%-ile  pilot,  and  we  are  for  the  moment 
specifying  that  each  nozzle  direct  its  nominal  thrust  line  through  the  50% 
pilot's  CG.  In  Equation  (4.24),  Ojxl  O^xS  matrices  of  zeros,  13x3 
is  the  3-by-3  identity  matrix,  m  is  the  seat/pilot  mass,  and  I  its  inertia. 


Working  with  accelerations,  the  submatrix  B  performs  the 
transformation  between  commanded  rocket  accelerations,  aj-  and  (Dj.,  and 
control  vector  u  as  follows: 


(4.25) 


u  =  (bTb)“1  bT 


(4.26) 


Equations  (4.18)  and  (4.19)  are  divorced  from  the  (simulation)  dynamic 
system  update  cycle  by  means  of  discretization.  If  t  represents  the 
current  time  sample  (ie,  t  =  T) ,  where  T  is  the  sample  period,  we  have 


^  j  •  hi>  .  ■  •  -  ■  • 
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a(n+l)  •«  aj(n+l)  +  Aa(n+1) 


(4.27 


where 


Aa(n+1)  “  aj(n+l)  -  a(n+l) 

-  k,j(aj(n)  -  a(n))  +  k2(v<j(n)  -  v(n)) 


(4.28 


Z- transforming  (4.28)  yields 


(aj-a)  (z-k 


0 


(4.29 


so  that  unit  circle  stability  will  result  if  kj  and  k2  are  chosen  with 
respect  to  T  so  that  both  solutions  of 


7(1  +  ki)±  (l+ki)2  -  4(ki+k2)  (4.30) 

z« - 

2 

are  less  than  1.0  in  magnitude. 

4.3.5  Linear  Analysis;  Stability.  Although  the  control  strategy 
depicted  in  this  chapter  is  a  nonlinear  reference  trajectory  control 
scheme,  it  is  important  to  study  the  properties  of  the  linearized  version. 
There  are  two  basic  reasons  for  which  such  a  study  is  necessary: 

(1)  In  the  current  control  strategy  a  nonlinear  decoupling  law 

is  implemented  on  line  with  some  approximations.  However,  since 
the  regulation  is  basically  around  either  the  offline  ESOP  or 
the  real  time  reference  trajectory,  one  may  use  a  linear 
quadratic  regulator  around  this  trajectory.  Such  a  regulator 
would  feed  back,  linearly,  all  the  observed  states  of  the  system 
and  would  achieve  a  certain  level  of  optimization  in  following 
the  reference  trajectory.  However,  since  the  system  is 
extremely  nonlinear,  the  feedback  gain  matrix  of  the  linearized 
system  will  change  along  the  trajectory.  But  it  is  possible  to 
use  a  limited  number  of  feedback  gain  matrices  (switching  from 


one  to  another  along  the  trajectory)  by  sacrificing  the 
reference  trajectory  tracking  performance.  A  linearized 
stability  analysis  can,  therefore,  shed  light  on  the  stability 
of  the  control  law,  and  on  whether  this  approach  is  feasible. 

(ii)  A  particular  point  at  which  the  behavior  of  the  system  is  of 

interest  is  the  end  point  of  the  reference  trajectory.  At  this 
end  point  the  seat  is  sufficiently  far  from  the  aircraft  and  is 
decelerated  so  that  a  new  control  scheme  can  take  over  to 
prepare  for  the  next  phase,  i.e. ,  for  the  parachute  deployment. 
The  linearized  version  of  the  system  at  this  end  point  specifies 
the  level  of  controllability  and  stability  of  the  seat.  On  the 
other  hand,  it  should  be  kept  in  mind  that  stability  analysis  is 
asymptotic  in  nature  and  will  only  provide  limited  information 
for  the  short  flight  durations  encountered  in  the  ejection  seat 
problem. 

The  study  of  the  above  properties  of  the  linearized  system  has  to  rely 
on  extensive  numerical  testing  and  analysis.  In  fact  the  complexity  of  the 
non-linear  system  and  its  precomputed  reference  solution  preludes  simple 
analytical  deductions  as  to  the  feature  of  the  linearized  system. 
Fortunately  for  moderate  size  linear  systems  there  exist  a  number  of 
powerful  and  fast  programs  to  test  the  stability  of  the  open  loop  system 
and  to  compute  the  optimum  gain  matrix  (in  the  LQ  sense).  The  six  degrees 
of  freedom  dynamic  model  for  the  seat  corresponds  to  a  12  dimensional 
linear  system.  At  SSI  a  program  developed  at  the  Stanford  University 
(OPTSYS)  has  been  adapted  to  a  12  dimensional  system  and  has  proved  to  be 
very  robust  and  fast.  In  this  section  we  will  discuss  the  linearized 
system  corresponding  to  these  different  points  (T=0,  T=0.1  and  T=0.2)  of 
the  reference  trajectory  corresponding  to  a  12  state  -  8  control  model: 

•  • 

X  =  Ax  +  Bu  (linearized  version  of  x  =  f(x,u)) 


with  A  :  12x12  matrix 


A  -  iL_ 

3x 

B  :  12x8  matrix 

B  =  il_ 

3u 

X  =  (Au,Av,Aw,Ap,Aq,Ar,Ax,Ay,Az,A9,A<t>,A\(i) 
u  =  (A9  J+A93  ,A<j)  j+A(|(3  ,A03— A0 ^  ,A4h~A^3 ,ATj , A62 , A(^2  »^T2) 
where : 

®1  i®3»<frl ,and  T2  stand  for  (see  configuration  In  Section  3. 2. 2. 3): 

rocket  nos.  1  and  3  nozzle  pitch  deflections  (9), 
rocket  nos.  1  and  3  nozzle  roll  deflections  ((^), 
thrust  for  rockets  1  and  3  (Tj) ,  and 

rocket  2  thrust  (T2),  nozzle  pitch  (02),  and  roll  (^2^* 

The  data  used  correspond  to  the  low  altitude  high-Q  escape  condition.  The 
matrices  A  corresponding  to  three  points  in  time  (T=0,  T=0.1  and  T=»0.2) 
together  with  their  eigenvalues  are  printed  in  Tables  A.l,  4.2  and  4.3.  As 
it  can  be  seen  the  matrix  A  and  its  eigenvalues  vary  significantly  from  one 
point  to  another.  A  remains  singular  and  the  corresponding  linear  systems 
are  all  unstable  (eigenvalue  having  positive  real  parts).  The  input  matrix 
B  is  the  same  for  all  these  systems  (Table  4,4)  and  the  stabilizing  gain 
matrix  C  is  computed  by  the  program  OPTSYS  to  minimize  a  quadratic  index  of 
the  form  [|IxI|2  +  llvi(2]dt.  These  matrices,  together  with  the 
corresponding  closed  loop  eigenvalues  are  printed  in  Tables  4.5,  4.6  and 
4.7.  The  gain  matrices  C  corresponding  to  different  points  of  the 
trajectory  are  different  from  each  other,  but  the  closed  loop  matrices 
(A-CB)  have  almost  the  same  eigenvalues.  This  can  be  explained  by  the  fact 
that  in  all  the  three  cases  the  same  index  is  minimized  while  keeping  the 
control  matrix  B  constant.  The  control  data  structure  remains  unchanged 
and  C  is  each  time  adjusted  so  the  matrices  (Ai-B^Ci)  have  approximately 
the  same  eigenvalues.  Such  a  result  would  not  be  possible  if  the  matrix  B 
were  to  change  from  one  point  to  another.  However,  if  one  relaxes  the 
minimality  of  the  index,  or  if  one  decides  to  minimize  an  index  of  the  form 
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TABLE  A. 2 


r*»  I.** 


A 

1 .d7L i-02 
7.956r-:)1 
6.Lei 3-J3 
3.u75;-J1 
1  .L22;-Li; 
L.L00i-»:L 
C.O  JCi*-'0 
9.  v-i7:-:i 


L  I  I-  ;  ~  -  c 

c 


-1 . 

.»57E 

-C2 

-5. 

'4l  9L 

-C3 

-7. 

49;e 

-03 

1. 

>33E 

-03 

4. 

iZtl 

-04 

-1  . 

3o9  1 

-02 

j. jl-l  ♦c: 

0.  3i-3c  ♦^Ci. 
1  . .L -I -C3 
1.  jl :l  ►L  ^ 
7.  2Lvt  -C  •« 

»c- 


-2.8S7?-31 
b.O  >3  =-33 
-1.3  J3E-32 
I.ei85-D4 
fc,3’,7i-33 
-2.3  }5*:-D4 
C.OOi*  JO 
C.uJCtf  JO 
-5 .Cl- r- J2 
-c.4>3  -.-J*. 
9.9  >7 -- J1 
C.C)0=^JG 


3.30  JE^OJ 

-  2.52  3£»01 

-  5. 44  3E-C  1 
-■4.372E-L1 

5. 95  >:-C  3 
-3.  J37E-C1 

I. JOJf^C  3 
3.  30  3E  *C  3 
3.  JCJCiC  3 

J. 30J' n  j 
3.  :G  3£*C  J 
J.  JO  -J1  *0  3 


2.520E  +  01 
Q.OOOH+30 
9.241 r+02 
-5.33C:-32 
-9.5te:-01 
-1  .8731-02 
-3.61e;-35 
1 .CCO:*OC 
C.OCCE  +  OL! 
C  .OJC  £•*•30 

c.ccci-^:c 

7.2c3£-j4 


c 

'9.2  41  £-*-j2 
I  .o-L£  +  jC 
2 . 1 

3.1  i4.--j 
't.-J  —  -  — 
'5.1.16^  — 
■■7.t1*i.-J4 

c  .cjl.-*j- 

G.OuL-^jC 

1 .c:i £+.0 

C.lJ'- 

C.uJt.+JC 

c.ljC:*~'l 

C.uwC^^JC 
C.C  JL  i-'-wC 
O.LLC  -I  +  JC 
c.c:oi-*jo 

C-OOGJ-^JO 
G  .L  JC  £-*3C 
G.O-G:.'*JC 
G.cJG-I+JC 
C.LjC^^jG 


j.  :l-e  *•03 
i.  £1 31  ♦Ll 
-£.  il  3C-LJ 
-  .  * 
-.  jt-t‘'C3 
•.  .  .CIE  »GG 
- ' . il JE -G2 

I.  4E  -CJ 
5  .  37  -  £  *  L  3 
i.  i*;Jl.*’Ll 
i.  i17E-Ll 
3.  i14E-C1 

:.  c‘C- 

.L-E*-o: 
...  Jt-  J  *C  J 
:.  iujE*-c.' 
0. 3u-t  ^GJ 
Jt'.  E*-0': 
G.  Ji-  'lE  ••CO 

J.  jC-EK- 
7.  4071  -Cl 
9.  14: £  *0 J 

-.  :o-j*c- 
J. JO :e ♦00 


--'.21 3.^  :i 
1.1  53r-33 
1.6l2i*30 
C.  G)0£^  30 
O.OCf^  JO 
0.  OlOf^JC 
-1.91 9E-32 
C.OOE-^DO 
2.1I2E+31 
-:.237£-:2 
-9. 242£*32 
•^.612  £-34 


3.30  3EH  3 
3.3'j3E»C  3 
3.3C  3P*C J 
3.  J03E»G3 
3.3C3E^C  3 
0.Ci03E»C  3 
3.3C3£^03 
3.30 JE ♦CO 
3.303E*G3 
0. 3D3E^L: 

3.30  3  E+0  - 

3.30  3E^C  3 


T=0.2 


C .0C0£^ JC 
C.CLC  £  +  3C 
G.C>3C£■^3C 
C.0-C£*J0 
c.coc  £-^:c 
c  .ci:o£-*  jc 
O.COC£-»3C 
C.CJCL-^OO 
C.C3C£'»3C 
C.CCC£-»  JC 
C.0CC£+3C 
C.OQC  £•♦''0 


Eigenvalues  (M) 

-3.120  +  J  4.021 
3.916 
3.101 
-3.122 
-.5346 

-1.974  E-3  +  j  1.795  E-2 
+  j  3.357  E-6 


TABLE  ^.3 


Input  matrix  B: 


B 

-1  .c53;  +  D2 
L  ■  Ij3C  jCJ 

-i.iiu*:: 

C.U JL  ;  +  wC 
-z  .C2C£  +  -ii 
C.L3Ci  +  :tj 

C • OCG ; ♦ jC 
L.L jO:+uC 

C.GGOi-^jC 

L.t3G;-*-jL 

C.OjO£*3C 

-5.4e4i+3Z 

C.uJOi*jL 

-c..S7cc'»w3 

-z.s  •51 

c.c:c:+:c 

L • G  wC : ♦ JL 
C«G./C  ;^j0 

C«  OwU.^JC 


3.  jg:£  ♦•(. : 

I. jc£L*'<  Z 

:.  :c:t  3 

-2.  U3E  ‘C_> 
3.  3C  jL  ♦C  J 
-1  .♦311:  -C. 
3. 3C3L  ♦Lt 

J.  iGUt  ^CL 
3. 

3.  JGGc*'Cu 
J.  JG:'E*-G'j 
3. 3l:e ♦CC 


C.033-*30 
C.C)C:*»30 
C.0  3C3+30 
-£.e  J62  +  31 
C.030r^30 
1.351  £^32 
0.030:«-30 
C.0)0  £♦30 
C.OOi^  JC 

0.0)0:^30 
I .03C£^30 
:.0)0£  +  30 


i.39  5: tC  I 
3.  30)£*C3 
1.33'>EfC2 
3.3G3£*C  3 
3.30  3E»C  3 
3.  303E*G3 
3.30  3c«-C3 
3.  DO  30 ♦C 3 
3. DO  3E^03 


D.DODE^OD 
D.DODE^CD 
D.  DODE^CD 


-1 .304:*'DC 
1.2^2:+0C 
-1 .:34:+0C 
-1.043E+aC 
C.COCZ+DC 
-6.9t6£-D1 
G.030E+CC 
C.CDCf^CO 
C .OOOZ^DC 


C.CCOE+30 
G.OOCE^jO 
C .C3C  Z  +  CC 


3.  3C;eK3 
7.  *0  3 

J.  jg:c*-oc 
-2.  J3:t  ♦•C2 
'3.  jL:e  *03 
-2. JtiE ♦c: 
c.  jc:e*>03 
3Cjc»-C3 
3. JLOE  *0  ) 
J.  JC3E*C’3 
3.  jGJL^GO 

J.  jl:e  ♦■c: 


'5.9>9£-31 
u.  3jOi*3C 
-7.9  J5£-3? 
G.0)0f^3C 
4.3 i7  £-1  V 
C.CDOi^DC 
C.O )CZ^30 
O.O'.Or^DO 
o.G30£^  on 
C.  C  31  £  ♦  33 
G.0  3;£^30 
0.03  'Z^DO 


T  1L  C^TIMHU  CiNTRDL  Gal\  MATRIX 


t.7:4i3.4,5?2'i?51U-Ll 

1  .Cil  JUci.3Ae  1S3‘:  ll-l. 
2. 2271  3  3Z  j9  58  >*.73  VG-Ci 
7.32>.r3i1  3950  :'c  37  5C-C1 

2  .2-''3J25i  >c3e  .'-75  :c-c : 

&.l6G1cUiC-4  \c15lL-G2 
6.A3i>  J2-1  jZ  i71i.;,3!L-C  7 
1  1  V  ii.  j1  j‘,  y5  A  i 

^  ,  Z  ■  J  'j7  ^  L  7  c  i  i t  i.  1 

3  .t  ;  7  I  Z  '<4  .  Z  7L-C  1 

*».0vc-7,'3  JL“L'i 

Z  .34'  .977  A  :>1  »  V  j;.  ;.L  -C  4 
1  :3"c  ij’7iL  -l  : 

^ f  - 1  =  /i  jc  :7  j7 1 
j.312.('<3(,_siZ  : 


-V.011S22-S1Q31  33o27D-C5 
-4.6 JQ 27 36 19  IS  11 30  SO -C  > 

1  .  1  335G-.1  -  Ot»S  SI  73  2G-C1 
-1  .4-J44C395113»031  lO-Ci 
-1.1 3?73S77133^7VC4D-C5 
-5.3!>7i0..C?Ci7i671  ?D-Ci 

77J2  V3..7  3?-C  1 
-1.7’tV  •54531  t4>5:4>[r-C  < 

-: . Z  3  *  >  5  7  5  -  3  23 1 25C  >L  -L  ; 
- : .  3  6  '  ^  1  >  7  » A  >  5  1  C  >  :  *■  C  2 

2  .  5  74  -ZaA'.  2  35  -.4,5  JL*'.  j 
Z.C  aC  79-5l  4  25  445‘'.r-C  , 

-  3  .C  .7 .357  *0  ;5  >2  3c  1  C  -C  3 
-1  .f:  57  ,4  )4  i2’  9  33  :i  SC-C  5 
-1  .t  35.  33'.^  J5?2  ::  15  1L-C1 
-c.  :  4  56  37  >3=;7  }3  2'5  2D-L  j 


1 .505  7799  71  9462127D-C1 
-1 .219?<25755671633C-C5 
-1 .741 729852»5e5S6’D-05 
-4.85351 3571465711 SO-02 
-5 .C 54 4  77255964630  SD-Ci 
-9.95  2  702  6  3254  275  9  5D-01 
-2. 221 33933693455670-05 
Z.49ei97Cl6’’711'1  5C-C3 

-t  .4  73  J59VI  35  3  34''34Ci-01 
3. 7 52 471 17526  1C  54 20-C 3 
2.675  i'CL7735972'^5  3C-C  3 
1 .C  33  3  44015  383247  2D^C  2 
:  .733  I  97  2  50  72595  2  iO<-C  : 
-7.2'2  2631  3271  5896  SD-C1 
1 .817)251 141513265D-C4 
-2.1 53  3? c9  2 5  53 5295  70 ♦02 


4.305!511117435?89D-0S 
-5.963355721 39492250-01 
-4.443i4:?22®559595C-C1 
1.131516038^3522230-05 
-4.371 7053595975393D-05 
1 .41?;4995514  397060-05 
-4.c56>5337:5220345D-C^ 
-:.9';06635  26  6e  75  6  l40-03 


-3.35845943431 947450-01 
3.14296401529123490-05 
4 .84  3  32  999354  3  8  3710-05 
3.23043703239303370-01 
1 .77950342768984950-0? 
-3.1121471 9526351050-01 
5.1  5742-44  7669  3“3?5D-06 
-9.7;674551633772e2D-C3 


-6.4^C?2;cI3125957):-01 
1  3  5  59  36  37  74  73  1  9  90-C5 

"8.79023643075796830-05 
-7.59W32387952735200-01 
-2.3774566 4071 983070-02 
-4.5  22  ^037  31  12  51  76  )0-0  2 
5.3944516)449521020-07 
1 .50715706450101430-02 


7 . 6-0. '^I?  76  71  yl  30  'L-L  1 
-4.L31:  047-4-c151‘.-L-Lj 
-7 .3  I6i1  -0  :2  :-!1  U  -t  b 
-  6 . 4  7  o  V  j  S  :  u  ■)  1  » 0  7  0  ,)  0  -  C  1 
-^.7,5  Ic  ■'4  35  11  I'.CcbO-L  : 

1  .0  65 ,3,9  7310  7jjc  3'.  -L  ) 
-1.37L;57  733c1'j)4iJ10-Lj 
2.051  23  38  71^1  )tt&3t.'-03 


Closed  loop  eigenvalues; 

-7.459  E3:  -&.A59  E3;  -3.938 
-2.240  E2;  -7.380  +  J  7.149;  - 


-7 .885  44  376055  569640-05 
-4.57S0331166C44751D-01 
8.87733975926161920-01 
-1  .02346708377337050-05 
-1 .1083278  4635  5  80610-0  5 
-1  .195  70470828  1705  DD-O*? 
-4.89573247973531520-02 
-1 .90578736376113550-07 


-5.5  <9  1  1  2  79, 1  71  >2-1  5 

-5.35‘,7=’v743i5 
6.'^V2  57  56>7,45515  ?t  ♦01 
-5 . 8  24 19^7  5t1 2 )6  21  3L -0  , 

-7.^4'  ^-91^)6  2755K-C  I 
-6.6  56 1 3  0?  1  453  5  3  45  >0-0 , 

-4.075  961761  >695:75U^C/) 

-1  .720  46  96  73)2  1  487  50-0  5 

t=0.0 


2;  -3.809  E2;  -1.433  E2; 

1.397  El  +  J  1.398  El;  -1;  -1 


TABLE  ^,5 


133 


Tifc  O’TIMftL  CJt.TRDL  CVI-J  MATRIX 


-6.7  3;:2b73;0;5  ?b24  50-C1 
1.2313i:03070J29ii]L-C  3 
9.377  3511  S9792ei1  iD-C, 
-7.246jHl21337;04StD-Ll 
-1.1y395^t9t59iV:9:[)“C2 
-1.t3c 99:919541141  :d-L1 
-2.o;o:3jC7C79x53‘^iL-L  ; 
1,4.,571_C7ti.o«j9<.5L“l.  ^ 

“2.tj74'/r3--4iJ  >5:. 

-1.31C3L7c.,:>7?lL?J3C-C1 
3 .6:5  >41  5 .61  4  7V:^‘  .^-L'l 
~1  .6325Vr4:4.15i£.1_jL~(.  « 
-2.19^7719  j9  •:4>7!:L:r  -i.; 
-5.o;.V.3;973..  :.l19::-C-> 
-3.1w: 3911  ♦;  il  17  :l-V  1 
2.*.il4t9C  114  330.9  'l-L  6 


-1.02614555252471330-04 
-S.9644C31 5937242850-01 
-4. 509  SC  99 3 3 33  1  5 36 70-01 
2.468 15?521365C301C-C4 
-4.3641231 7732406140-03 
4.961  23374923  373650-05 
-6. 9 45  2909  92 93 0647 2 0-C  1 
-6.6937C43533673935D-C6 

-6.74504255031 366070-01 
1.193!699C5953Ce55D-0? 
9.6557568  99676893  30-0  4 
-7. 36324733008322230-01 
-2.2423075 05924181 90-02 
-4.6464811 1956364620-02 
-7.311  34  04  71  3  0  01  4770-0  5 
1 .434,10  46  79  37  470810-0  2 

7.i74>:6l  76  2c.:34:rL-(.|  - 
4». 013413^4331  jwt  6 'L-Ci  * 
5.2jV044753j1  «ll6lL-0t 
0.7  39  «5  ^9 ;1 64  :c ;1 91-L  1 

3.017.6.1  >3^4  it:l 7L-C  :  - 
V.OJ7/54C3:’12il.V20-C4 
2.291  17  66  3056  it41  il'-Cf  - 
i  .  0;3  31  6e  31  1  5  59  51  .’[)-02  - 


Closed  loop  eigenvalues: 

-7.459  E3;  -7.459  E3;  -3 
-1.476  E2;  -2.238. E2;  -7 
-1.393  El  +  J  1.396  El; 


-1 . 0  4M6  35  j1  9L'-C  ; 

-4 . 5 51 >641 .939 1394 >£-C 2 
1  .  1  t<321  30  51  7C  1^  76  9D-CI 
-5 .0 3e 427'  >574 >425 1 D-C >  - 
-1  .7  96  iC2  12  75  IC-C  5  - 

-1  .  6  67 ’6  23. 474  473? 3D-t 3  - 
9.9.4.6  75  •.  2  90  ^7*090-01  - 

6.t  >2  45>3  .09v7S-.l  3t_-C  7 

-1  .  :  j?  36  >1  !•:  35  >5  Z7  I'J-L  2  - 
-2.  5  S7  93  31  : \04  ’ ^4  lO-c  9  - 
2 . 0>71  7>S  1  :.*>5  3.>6  5C*C  ?  - 
4 .0  3C  >5  iv  72.  045  12  SC  'C  ; 
-7.1  >=  29  3  6  34  17  53. L;L'-Ci 
r..  ^13  5t  55  '2  i7  3  1.2  il  -0  4 
-1 .4  ^5 1 0>4  7631  *5  3?  50-0  I 
-1  .C  ■•7  .  7-4  5G?3  3C77  9t -0  5  - 


-3.53054033261 739470-01 
-1 .49533003541  303750-03 
-7.421 5 5 39 1935263430-04 
3.0? 8 68 74 7965 28 50 30-01 
1 .74233173285788350-02 
-3.031 36751927853330-01 
1 .33279543971 772660-04 
-9.4  93  71  49  2111  5276 20 -C 3 

-1.421 77539259859370-04 
-4. 61 9 170C 5 897 94 39 20-01 
8.85472984432102230-01 
5. 31775745641 593470-04 
-1.10245932169302720-03 
-1.10245491371 582510-05 
-  5. 06  8 23 20 3276 81 36 DD-0 2 
-1  .  51  5  923731325911  30-05 


.9:9  .430  - 11  ,7  9r-c' 

.‘•9921  >77651:530  20^£I 
.531  57  3/  .29  354rt5r*Cl 
.  3  ’cl6  94  701C,Cv:6L-C: 

.  '  '5  94  ,2  1  Oi2  .ft  99  y 

. 0 : 9  >  5  78  371  8  72  :5  iL-CV 
. 07832352541 9;5330^Cj 
.  3  30  1  2  81  752..37J73C-C  ; 


.822  E-»-2;  -3.710  E2; 
.258  +  J  7.039; 

-1.;  -1.43 


1  .57238867665192630-01 
4.591 467270803321 40-04 
2.C344771314215521D-04 
4.401 858266481266 3D-C 2 
4  .948  7311  10379845  20-03 
9.955792e3217674fr4D-C1 
2.89634433567347730-05 
2.425  »354:27391  7C3f'-03 

c.245397:875:43?350^C1 
4.96533'6;199::J3.0-C1 
2. 737'.S:5  2390139510-01 
1 .070>251 1212914970^C2 
5.6ZZ1956?7i419o1 50»C3 
7.1369715’715  764C2D-01 
3.4423705S64755451C-C2 
3.111 5441 50652971 SD’C? 


t=0.1 


TABLE  4 . 6 


Tit  OPTIHIL  CJMR3L  Gili 


0  .o;::  57  JA  71  VS  >934  70-01  -2 
3.1  50  I 51Z 1038  3993  7C-03  -5 
Z.91o7SPL;c60  ♦7502C-03  1 

7.9j3  2:5C  :  7  69  765l  :c-Li  -1 
c.cVdAsll  t:9j4yij5cCC”0J  ~3 
7  .4  9o  ;2  3  7  52  5^  >4.  58  iL-O  :  -8 
fc.j.‘3jc33j174jC5tiL-L-»  9 

1  .4  54  ;9:5  52 ■:  5 :: ::  .L-L  :■  2 

7 . 658 1 3  5i  r:  10  Ki?  7r -L  5  -3 
1  ...539939:33: ; 3  27  5-. -01  -2 
3.0735  357  .:;,1  7^-L  1  1 

S  .  L  3  S  .  .  .  2  ; ^  .  y  .  2  3  ^  -  3'  ^  “ 

3 . 1 54  ;c  3'j  _5  •.  4  jL-t ;  -4 

3  .S  5  2  103l  ,  :c  '-I  H-d  -i 

J  .  1  5  8  5,  .,0  >  9  Jt  1  6-L  1  -  1 

9  .  u 0  3  U  3  :  7  3 9  : u  •.  3  :  t  -c  5  -  2 


-3.C645643S36139621C-04 
-9.C04D252  7231  25  33  30-C1 
-4.413^9457135146450-01 
6.711 69345340373730-04 
-4 .3  50  3  7'5271  32736950-03 
1 .8i24tf7672467Tl60-04 
-1.2355971 11 15 J5253C-03 
-1 .838  341  6  1  644  726630-05 

-6.8737*1255521 33260-01 
2.401 3C397P137653 ;0-C3 
3.3  56  3089  52  1  1  58.,l  30-03 
-7 . 24C  45  36  54  D6  2731  3D-C1 
-2.1 7255302120703640-02 
-4.3D87536507425S23D-02 
-1 .68334233197262710-04 
1  .  396  i2  39  5  675  1  6  06  5D-C2 

y.cH^izdz  591.7  70-0  1 
...cJI  8lfc-2  5V5..>5564L  —  L  . 
c  .  L  ^  i  i ')  i>  t  .  7  .  ^  i7  I  -i  I L ~ i  ! 
-c . .  7o  6i  ji  1  c  . .1 :9  :l  -0  1 
-^.c6L  54i(.25‘4  5  5loiL  —  0'_ 
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CHAPTER  5 


TASK  3:  HARDWARE  IDENTIFICATION;  TRADE  STUDY 
3 . I  InLroducL ion . 

This  section  summarizes  work  to  date  on  Task  3  of  the  project 
described  in  this  report. 

In  Task  3,  the  control  system  was  to  be  used  to  quantify  energy 
requirements.  Based  on  this  and  related  analysis  of  escape  trajectories, 
the  control  logic  was  made  more  efficient,  and  a  parameter  selection 
methodology  was  developed.  Other  Task  3  activities  included  a  survey  of 
microprocessor  technology  for  suitable  architectures  to  handle  the  control, 
sensing  and  sequencing  activities  of  crew  escape;  and,  an  analysis  of 
representative  control  system  hardware  components,  to  aid  in  selecting  the 
appropriate  ones  for  the  control  system. 

The  main  results  presented  in  this  chapter  are  that  the  overall  energy 
requirements  are  about  twice  the  capacity  of  current  technology  seats,  for 
control  schemes  which  use  only  propulsive  energy,  although  if  a  design 
develops  which  allows  main  thruster  cutoff  at  dynamic  pressures  greater 
than  600  Q,  the  energy  req<i Lrements  would  redtice.  Also,  although  sensor 
technology  seems  capable  of  providing  instruments  which  meet  the  needs  of 
use  on  ejection  seats,  there  remains  a  considerable  "packaging"  problem; 
if  this  forces  elimination  of  key  sensors,  the  microprocessor  could  be 
burdened  with  severe  estimation  duties.  Ideally,  the  controller  will 
receive  angular  and  linear  acceleration,  angular  rates,  and  local  vertical, 
in  addition  to  the  atmospheric  data  now  available  on  the  ACES  [I  prototype. 
Direct  measurement  of  wind  velocity  direction  would  be  a  great  aid  in 
controller  efflcieticy,  but  perha()s  could  be  omitted.  Finally,  measurement 
oF  ambient  temperature  could  he  used  by  the  controller  to  model  more 
accurately  the  propulsive  thrust  profiles. 

Our  studies  also  indicate  that  near  state-of-the-art  propulsion 
technology  will  he  adequate  for  the  thrust  levels  and  slew  rates  developed 
by  the  isintroller,  provided  the  energy  leads  to  units  which  can  be  fit  on 


the  seat.  The  concurrent  selectable  thrust  design  project  has  provided 
useful  data  in  quantifying  propulsion  requirements  more  completely. 

5.2  Task  3  objectives 

A  major  objective  of  Task  3  is  to  assess  the  degree  to  which  the 
control  requirements  specified  for  this  project,  and  the  control  system 
which  is  to  implement  these  requirements,  strain  state-of-the-art  hardware 
technology.  There  is  no  doubt  that  self-contained  control  of  an  ejection 
seat  in  the  specified  escape  regime  (cf.,  M1L-S-9479B)  places  several 
technologies  near  their  current  limits.  The  myriad  requirements  of  size, 
weight,  reliability,  and  performance  in  extreme  dynamic  conditions  over 
very  short  time  periods,  necessarily  represent  an  interesting  and  exciting 
challenge  to  designer  and  manufacturers  of  seat  components. 

The  control  system  is  at  the  heart  of  these  issues.  During  the  first 
part  of  this  project,  we  have  developed  a  design  which  offers  promise  of 
performing  exceptionally  the  difficult  control  task.  We  now  describe  the 
phase  of  the  project  in  which  it  is  necessary  to  assess  how  well  a  concept 
developed  on  a  computer  will  perform  in  the  "real  world”.  The  answers  are 
affirmative:  that  our  control  scheme  is  a  viable  one,  and  that  the 
technology  is  at  or  near  to  the  necessary  levels  to  realize  this  major  step 
in  reducing  the  hazards  of  crew  escape.  We  shall  see  this  in  upcoming 
chapters  in  this  report. 

The  main  goal  of  Task  3  is  to  study  and  identify  hardware  components 
so  that  a  hardware  breadboard  design  can  be  developed.  The  Task  3  SOW 
items  are  now  summarized: 

Quantify  the  energy  requirements  to  accomplish  the  desired  control 
task,  while  maintaining  accelerations  on  the  ejectee  to  within  tolerable 
limits. 

Investigate  and  identify  state-of-the-art  microprocessor  technology 
with  respect  to  its  peformance  of  the  digital  computational  requirements  of 
the  controller,  and  its  duties  in  controlling  and  sequencing  the  major 
ejection  events. 
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Conduct  an  evaluation  and  trade  off  analysis  to  select  hardware  for 
tile  control  system  design. 

5.1  Microprocessor  Hardware  Component  Survey. 

This  section  documents  the  results  of  a  preliminary  microprocessor 
hardware  component  survey  to  determine  microprocessor  throughput 
requirements  for  the  ejection  seat  controller,  and  then  to  compare  these 
requirements  with  currently  available  and  projected  microprocessor 
technology . 

In  order  to  quantify  throughput  requirements  while  the  actual  control 
laws  were  under  development,  it  was  necessary  to  make  some  assumptions 
about  the  form  the  control  laws  would  take.  To  this  end  the  simple 
attitude  controller  shown  in  Figure  5.1  was  examined.  The  inputs  to  the 
controller  are  noisy  angular  rate  measurements.  The  state  of  the 
controller  consists  of  estimated  angular  rate  and  estimated  angular 
position  (integrated  angular  rate).  Notice  that  angular  rate  and  angular 
position  are  scaled  such  that  multiplication  by  the  integration  timestep  is 
not  necessary.  It  is  assumed  that  the  applied  control  has  the  same 
dimension  as  the  angular  rate  measurement. 

Therefore,  F.qiiations  (1)  through  (5)  in  the  figure  represent  a  filter 
that  estimates  the  full  state  based  on  a  transition  matrix  to  update 
angular  rate  (Equation  (1)),  first  order  integration  of  angular  rate  to 
obtain  angular  position  (Equation  (2)),  and  a  set  of  filter  gains  to 
incorporate  the  new  measurement  (Equations  (3)  ,(4)  ,( 5) )  . 

With  the  state  estimate  thus  obtained  the  controller  calculates  a 
control  l;i’iar  ;  ii  tlie  state  (Equation  (6)). 

To  the*  right  of  each  equation  is  an  operation  count.  The  count  does 
not  include  the  calculation  of  the  transition  matrix,  filter  gains  or 
control  gains.  It  is  assumed  for  the  moment  that  these  quantities  are 
constant  or  obtained  by  a  table  lookup.  The  gains  for  the  filter  could  be 
precomput cfl  Kalman  filter  gains,  the  control  gains  could  be  precomputed  LOR 
gains,  or  they  could  be  derived  by  some  other  technique. 


For  the  case  of  a  full  three  degree  of  freedom  controller  (3D0F)  the 
number  of  multiplication  operations  is  45,  and  the  number  of  additions  is 
also  45.  A  IDOF  controller  requires  5  multiplies  and  5  adds.  Three 
uncoupled  IDOF  controllers  require  a  total  of  15  adds  and  multiplies. 
Computational  requirements  for  2D0F  controllers  are  calculated  similarly. 

It  should  be  noted  that  Kalman  gain  and  covariance  matrix  calculations 
increase  the  computation  requirements  to  about  three  times  the  total  shown 
(  15  n  )  if  they  are  performed  at  runtime  at  the  same  rate.  A  similar 
increase  would  follow  if  LQR  control  gains  were  computed  at  runtime. 

Currently,  measurement  rates  and  loop  closure  rates  of  500  Hz  are 
under  consideration.  This  rate  is  consistant  with  the  ejection  seat 
dynamics  observed  in  RASIEST  simulation  runs,  although  it  may  be  possible 
to  reduce  the  rate  somewhat  without  affecting  performance.  At  this 
measurement  rate,  throughput  requirements  are  22,500  multiplies  and  adds 
per  second  of  operation  for  the  3D0F  controller  mentioned  above. 

The  [ntel  8086  was  chosen  as  representative  of  current  technology. 
Within  the  tolerance  required  for  this  discussion,  it  is  comparable  to,  if 
not  slower,  than  other  parts  such  as  the  Motorola  68000.  Sixteen  bit 
integer  arithmetic  was  assumed  sufficient  for  the  accuracy  and  stability 
reciuirments  of  the  controller.  An  Instruction  mix  of  move  to  register, 
multiply  from  memory,  and  add  to  register  repeated  three  times  followed  by 
a  move  memory  to  register  instruction  was  taken  as  represent ive  of  the 
instruction  mix  that  an  assembly  language  programmer  would  generate  for  the 
algorithm  given. 

This  instruction  mix  gave  calulated  execution  times  of  35  microseconds 
per  multiply  with  a  5  MHz  clock,  and  22  microseconds  for  the  8  MHz  clock. 
These  times  correspond  to  throughputs  of  45,500  multiplies  per  second  (8 
MHz)  and  28,400  multiplies  per  second  (5  Mhz) . 

Thus,  an  assembly  language  programmer  might  be  expected  to  implement 
the  3r)0F  attitude  controller  with  constant  coefficients,  16  bit  integer 
arithmetic,  and  run  it  successfully  at  500  Hz  on  an  8  Mbz  8086.  The 
chances  of  success  with  5  MHz  8086  would  be  marginal,  due  to 
simplifications  made  and  overhead  ignored  in  the  argument  above. 
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If  the  inner  loop  were  implemented  in  a  high  order  language  the 
assumptions  made  above  would  hold  only  if  the  compiler's  code  generator 
were  very  efficient.  This  is  generally  not  the  case,  but  the  situation  may 
improve  as  compiler  technology  matures.  It  is  very  likely  that  compiler 
inefficiencies  will  be  compensated  for  by  increased  hardware  speed. 

If  32  bit  arithmetic,  or  floating  point  arithmetic  were  desired,  or  if 
any  other  of  the  assumptions  made  above  are  violated,  it  is  likely  that 
current  microprocessor  technology  (as  represented  by  the  8086)  would  not 
suffice.  However,  the  addition  of  other  hardware  (i.e.  floating  point 
support  chips,  array  multipliers)  or  a  change  In  the  algorithm  would  bring 
the  system  into  the  realm  of  feasibility  with  current  technology. 

Future  microprocessor  technology  is  difficult  to  predict.  However, 
since  the  current  technology  appears  marginally  feasible,  it  is  fair  to 
predict  that  the  situation  can  only  improve.  Commercial  microprocessor 
technology  is  not  necessarily  moving  toward  greater  throughput,  but  toward 
better  high  order  language  support  (as  in  the  Intel  iAPX-432),  or  to 
greater  miniaturization  (higher  memory  density)  or  toward  lower  power 
consumption, 

5. A  Microprocessor  design 

This  section  of  the  report  will  identify  architecture  and  design 
issues  relating  to  microprocessor  implementation  of  the  ejection  seat 
control  algorithm.  The  section  will  discuss  system  operational 
requirements,  constraints  and  requirements  on  physical  characteristics, 
computational  requirements  of  the  control  algorithm  and  the  implied 
architecture  and  software  requirements,  including  event  detection  and 
sequencing,  and,  finally,  will  address  requirements  and  capabilities  for 
built  in  test  and  graceful  degradation. 

5. A. I  System  Operational  Requirements.  Aside  from  the  operational 
requirements  of  the  escape  system  during  an  actual  ejection,  there  remains 
to  be  discussed  certain  operational  requirements  on  the  escape  system 
during  times  other  than  an  escape  event.  It  may  be  desirable  to  have  some 
portion  of  the  escape  system  operational  when  the  aircraft  Is  in  flight. 


either  continuously  or  periodically,  and  when  the  aircraft  is  on  the  ground 
undergoing  periodic  maintenance. 

Such  operation  could  be  justified  for  two  reasons.  First,  built  in 
test  and  system  "fail  safe"  considerations  provide  an  argument  for 
continuous  or  intermittent  operation  of  at  least  part  of  the  system.  The 
system's  built  in  test  equipment  (BITE)  can  be  more  effective  if  it  can 
isolate  potential  system  failures  prior  to  an  ejection.  The  ability  to  do 
this  in  no  way  suopends  the  requirement  to  isolate  faults  occurring  during 
an  ejection,  but  it  does  simplify  the  task.  In  particular,  microprocessor, 
memory,  and  power  supply  failures  can  be  identified  more  easily  on  the 
ground  or  during  normal  flight  than  during  an  ejection  for  reasons  of 
available  time  and  reduced  computation  requirements.  Should  such  failures 
be  discovered  during  flight,  the  escape  system  could  disable  active  control 
in  favor  of  conventional  control,  and  indicate  to  the  pilot  that  the  escape 
system  will  perform  in  a  reduced  performance  mode  if  an  ejection  becomes 
necessary.  It  is  doubtful  that  sufficient  time  would  exist  for  the 
performance  of  a  thorough  system  memory  test  during  the  few  milliseconds 
available  between  the  time  the  ejection  is  initiated,  and  the  time  that 
memory  is  required  by  the  control  algorithm. 

A  second  argument  for  continuous  operation  is  the  potential 
requirement  for  the  escape  system  to  maintain  an  attitude  reference 
independent  of  the  aircraft's  attitude  reference.  This  attitude  reference 
would  be  used  for  the  vertical  seeking  function  of  the  escape  system,  and 
could  be  periodically  checked  against  the  aircraft  attitude  reference,  if 
available,  as  a  means  of  verifying  accelerometer  and  attitude  sensor 
operation . 

For  example,  if  the  escape  system  is  equipped  with  strapdown  angular 
rate  sensors  and  accelerometers  for  the  primary  attitude  rate  and 
acceleration  control  function,  the  same  sensors  could  provide  a  vertical 
reference  as  a  secondary  function  by  using  a  software  mechanized,  self 
erecting  attitude  reference.  Using  current  strapdown  rate  sensors,  the 
primary  attitude  rate  information  can  be  supplied  in  minimal  startup  time. 
Attitude  information,  if  not  available  from  other  sensors  such  as  radar 


altimeters  or  ground/sky  direction  sensors,  can  only  be  obtained  from  long 
time  averaged  inertial  acceleration  information  or  similar  estimates  of  the 
local  gravitational  acceleration  vector.  Thus,  the  requirement  for  a  local 
level  attitude  reference,  obtained  independently  of  aircraft  systems,  can 
result  in  the  requirement  to  operate  the  attitude  rate  sensors  and 
accelerometers  for  some  minutes  prior  the  ejection.  This  requirement  is 
independent  of  the  physical  startup  time  of  the  sensors,  and  can  be 
eliminated  if  the  attitude  reference  is  obtained  from  the  aircraft  or  an 
external  reference. 

The  operational  nature  of  the  system,  as  discussed  above,  is  mentioned 
for  its  effect  upon  the  microprocessor  energy  requirements  and  cooling 
requirements.  Continuous  operation  of  at  least  some  part  of  the  system 
will  require  continuous  power  and  continuous  cooling  requirements,  implying 
an  external  power  source  as  well  as  an  on-board  power  source.  If  the 
system  is  operational  only  during  an  ejection,  power  requirements  can  be 
met  solely  by  an  on-board  energy  source. 

The  most  desirable  system  configuration  is  one  in  which  the  escape 
system  operates  nominally  without  external  power,  and  without  information 
from  the  aircraft  data  bus,  but  which  can  take  advantage  of  aircraft  power 
or  data  if  it  is  available,  and  can  be  used  to  good  effect, 

5. A. 2  Computational  Requirements.  There  are  at  least  three  distinct 
types  of  processing  that  must  be  performed  by  the  microprocessor  in  its 
control  of  the  escape  system.  First  is  what  might  be  described  as  the 
synchronous  processing  performed  by  the  closed  loop  controller  and  steering 
algorithm.  This  processing  is  synchronous  with  periodically  sampled  sensor 
inputs,  it  is  cyclic,  i.e, ,  essentially  the  same  processing  is  performed  on 
each  input  sample  set,  and  the  processing  is  largely  independent  of  the 
data  being  processed.  This  processing  will  largely  determine  the 
microprocessor  throughput  requirements,  in  terms  of  operations  performed 
per  second. 

The  second  type  of  processing  is  that  associated  with  event  detection 
and  sequencing.  This  category  includes  canopy  jettison,  restraint  harness 


retraction,  drogue  deployment,  survival  kit  and  parachute  deployment,  as 
well  as  critical  subsystem  self  test.  This  processing  is  asynchronous, 
acyclic,  and  data  driven.  The  throughput  requirements  that  this  processing 
imposes  are  not  a  primary  concern,  but  the  asynchronous  nature  of  the 
processing  and  the  precise  timing  requirements  will  determine  the  interrupt 
latency  of  the  microprocessor,  and  possibly  require  additional  hardware 
support  if  sub-millisecond  timing  requirements  exist. 

The  last  classification  consists  of  off-line  maintenance,  self  test  or 
BITE  processing,  or  similar  low  criticality  "background"  processing 
performed  prior  to  an  escape  event.  This  type  of  software  is,  by 
definition,  not  critical  to  the  primary  function  of  the  system,  and  does 
not  impose  limiting  timing  or  throughput  requirements.  It  may,  however, 
impose  non-volatile  memory  requirements  if  a  significant  amount  of  such 
software  is  required. 

5.4.3  Microprocessor  Event  Timing  Capabilities.  With  reference  to 
system  requirements  outlined  in  the  preceding  section,  it  is  necessary  to 
review  the  capability  of  current  microprocessors.  In  addition  to  the  "raw" 
capability  of  the  processor  itself,  some  attention  should  be  given  to  the 
capability  of  the  processor  in  conjunction  with  the  high  order  language 
compiler  in  use,  as  well  as  other  software  support  that  may  be  considered 
useful,  such  as  a  real  time  executive. 

First,  interrupt  timing  and  latency  will  be  examined.  Taking  the 
Motorola  bSOOO  as  representative  of  the  class  of  processors  under 
consideration,  one  finds  that  approximately  44  clock  cycles  are  required  to 
acknowledge  the  interrupt  exception,  that  is,  44  cycles  elapse  from  the 
time  the  microprocessor  begins  processing  the  interrupt  to  the  time  the 
first  instruction  of  the  interrupt  handler  can  execute.  Most  interrupt 
routines  require  the  use  of  several  processor  registers,  an  must  therefore 
save  and  restore  those  registers  to  be  used.  A  typical  interrupt  routine 
might  save  and  restore  eight  registers;  this  requires  192  processor  cycles 
if  the  move  multiple  instruction  is  used.  Finally,  the  return  from 
interrupt  (or  return  from  exception  on  the  MC68000)  requires  an  additional 
20  cycles.  The  total,  256  cycles,  represents  the  additional  processor 


overhead  required  to  process  a  single  Interrupt,  exclusive  of  the  actual 
interrupt  processing  itself. 

An  event  timing  and  sequencing  implementation  with  a  timing  accuracy 
of  one  millisecond  can  be  readily  obtained  with  a  software  clock  updated 
every  millisecond  by  an  interrupt  handler.  This  level  of  accuracy  is 
consistent  with  the  escape  system  timing  requirements.  An  eight  Megahertz 
MC68000  will  therefore  lose  256/8000  of  its  capacity,  or  about  3.2  percent, 
if  it  services  interrupts  every  millisecond. 

It  should  also  be  noted  that  the  interrupt  latency  is  insignificant  in 
this  context.  An  interrupt  cannot  be  serviced  until  the  currently 
executing  instruction  has  completed.  On  the  MC68000  the  longer 
instructions  range  from  70  cycles  for  a  multiply,  to  158  for  a  divide,  to 
176  for  a  sixteen  register  move  multiple  register  instruction.  Again  with 
an  8  Megahertz  clock,  this  only  amounts  to  about  .02  milliseconds  in  the 
worst  case. 

The  timing  and  sequencing  functions  of  escape  systems  are  easily 
within  the  real  of  current  16  bit  microprocessor  implementation,  so  long  as 
the  implementation  does  not  incur  undue  overhead  in  the  event  handling 
processing  software  (this  possibility  is  discussed  a  following  section). 

5.4.4  Microprocessor  Self-test  Capability.  The  capability  for  self 
test  in  current  microprocessor  lies  mainly  in  the  realm  of  system  design 
for  fail  safe  hardware  and  software  self  test  mechanisms.  This  type  of 
system  design  is  probably  better  understood  in  the  hardware  arena;  a  fail 
safe  software  design,  along  with  graceful  degradation  properties  desired  in 
escape  systems,  can  be  difficult  to  achieve  or  demonstrate  in  actual 
practice,  and  the  probability  of  success  is  directly  realated  to  the 
complexity  of  the  software.  The  use  of  currently  accepted  good  design 
practice,  high  order  languages  such  as  Pascal  or  preferably  Ada,  and  a 
sound  testing  and  verification  methodology  provide  a  basis  for  software 
reliability. 

Assuming  that  the  system  software  is  inherently  reliable  and  free  of 
design  errors  and  coding  errors,  there  remains  the  issue  of  incorporating 
the  microprocessor  controller  into  the  overall  system  self-test  mechanism. 


The  only  microprocessor  known  to  the  author  that  directly  provides 
inherent  self-test  capability  is  the  Intel  lAPX— 432.  This  microprocessor 
(actually  a  micro-mainframe)  can  be  configured  as  a  dual  processor  system. 

Tn  this  system,  each  processor  compares  its  data,  address  buss,  and  control 
lines  with  those  of  the  other  processor.  Both  processors  are 
simultaneously  executing  the  same  program.  Any  discrepancy  an  indication 
of  a  failure.  This  approach  will  increase  the  overall  system  failure  rate, 
but  will  reduce  ciie  probability  of  an  undetected  failure.  Also,  even 
though  the  system  is  redundant,  microprocessor  failures  are  only  detected, 
not  corrected. 

Aside  from  using  redundant  system  components  as  in  the  case  above,  a 
microprocessor  can  perform  useful  system  self-test.  During  available 
system  warmup  time  (quite  likely  limited  in  an  escape  system)  various 
microprocessor  self-tests  can  be  performed,  including  verification  of 
internal  registers  and  the  ALU,  memory  tests,  power  line  condition,  and 
certain  types  of  I/O  interface  tests.  For  example,  sensors  can  be  designed 
to  produce  characteristic  outputs  during  their  warm-up  time;  a  failure  to 
observe  the  transient  would  indicate  possible  sensor  or  I/O  interface 
failure. 

Digital  outputs  can  be  verified  when  sensors  exist  to  measure  the 
desired  effect  of  the  output.  Examples  of  this  type  of  system  self  test 
are  position  sensors  on  motor  gimbals  to  verify  steering  commands,  or  using 
the  system's  accelerometers  to  verify  the  correct  operation  the  propulsion 
system. 

Closed  loop  self  tests  of  the  type  described  above  have  the  failing 
that  a  problem  may  not  be  easily  isolated,  and  there  remains  the  issue  of 
how  the  system  should  be  designed  to  respond  to  a  fault  condition  detected 
by  the  microprocessor. 

A  simple  but  effective  means  of  ensuring  fail  safe  operation  under 
certain  types  of  failures  is  the  use  of  a  "keep  alive"  circuit.  An  example 
of  this  might  be  the  inclusion  of  an  additional  output  from  the  controller 
to  the  motor  actuator  hardware.  This  output  would  be  strobed  by  the 
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controller  software  each  time  the  control  loop  executed  successfully  as  far 
as  can  be  determined  by  the  control  software.  Absence  of  that  signal  would 
be  interpreted  by  the  actuator  as  a  system  failure;  the  actuator  would 
respond  by  slewing  to  a  nominally  centered  position.  This  scheme  is  most 
reliable  if  the  signal  path  of  the  keep  alive  is  the  same  as  that  of  the 
normal  commands,  and  if  each  component  in  the  path  tends  to  fail  in  a  way 
that  blocks  the  signal. 

Certain  types  of  self  test  might  well  be  avoided.  It  is  tempting  to 
run  microprocessor  register  or  memory  test  software  in  real  time,  as  a  low 
priority  process  executing  in  the  background.  This  would,  in  principle, 
provide  the  earliest  possible  indication  of  memory  or  microprocessor 
failure,  but  the  nature  of  such  tests  produces  extremely  unpredictable 
system  failures  when  the  self  test  software  has,  for  some  reason,  failed. 
The  more  conservative  approach  of  performing  such  tests  prior  to  system 
operation  is  preferred. 

A  final  type  of  self-test  software  remains,  that  of  verification 
software  that  runs  off-line,  as  when  the  system  is  down  for  maintenance. 
Off-line  self-test  can  enhance  system  reliabilty  by  facilitating  preventive 
maintenance.  The  operational  caveat  associated  with  this  type  of  software 
is  that  it  occasionally  requires  more  memory  and  development  time  than  the 
primary  system  software.  In  addition,  it  should  be  remembered  that  it  is 
difficult  to  devise  diagnostic  software  that  stresses  the  system  as 
thoroughly  as  actual  operation  does. 

5.4.5  System  Hardware  and  Software  Architecture.  The  effect  upon 
system  architecture,  both  hardware  and  software,  of  the  system  requirements 
discussed  is  likely  to  be  more  due  to  reliability  issues  than  throughput 
issues.  As  mentioned  in  the  Task  I  interim  report,  the  throughput 
capabilities  of  current  microprocessors  appear  adequate  to  the  task  of 
ejection  seat  control,  and  as  mentioned  above,  the  event  sequencing  and 
detection  requirements  are  also  within  the  capacity  of  current 
microprocessors.  Thus,  multiprocessor  configurations,  or  other 
architectural  innovations,  are  not  anticipated  on  the  basis  of  throughput 
requirements  alone.  The  overpowering  need  for  system  reliability  may. 
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however,  be  addressed  at  the  architectural  level.  Such  architectural 
decisions  such  as  whether  to  use  redudant  Independent  hardware,  data  and 
signal  paths,  or  to  take  the  alternate  approach  of  a  single,  monolithic 
organization  with  conservative  design,  will  generally  be  driven  by  con¬ 
siderations  of  reliability. 

What  hasn't  been  examined  in  detail  in  the  area  of  microprocessor 
throughput  is  the  effect  of  software  tools  and  products,  particularly  the 
high  order  language  compiler  and  the  real  time  executive  software  used  (if 
any).  While  the  advantages  of  using  a  high  order  language  can't  be 
overstressed,  one  must  consider  the  effect  a  compiler  will  have  on  the 
throughput  of  the  microprocessor/compiler  combination. 

The  efficiency  of  a  compiler,  compared  to  that  obtained  (presumably  at 
greater  expense)  by  assembler  or  hand  coding  techniques  is;  determined 
partially  by  the  nature  of  the  instruction  set  of  the  machine  or  the 
language  used,  but  is  determined  almost  entirely  by  the  effort  put  into  the 
development  of  the  compiler.  Compilers  that  produce  code  that  compares 
favorably  with  that  produced  by  hand  coding  do  exist,  but  unfortunately, 
are  the  exception.  This  is  particularly  true  for  microprocessors.  It  is 
hoped  that  Ada  compiler  developers  will  go  to  the  effort  required  to 
achieve  acceptable  code  optimization  for  that  language,  especially  in  view 
of  the  fact  that  the  language  was  originally  developed  for  imbedded,  real 
time  applications  software.  The  Pascal  compiler  being  used  for  the 
demonstration  software  development  is  typical  in  that  it  is  not  known  for 
producing  highly  efficient  code,  and  can  therefore  be  used  to  identify 
potential  problems  in  this  area. 

Another  area  of  software  architecture  concerns  the  use  of  a  real  time 
executive.  A  real  time  executive  provides  software  support,  generally  to 
the  user  of  a  high  level  language.  In  the  area  of  synchronous  and 
asynchronous  event  handling.  An  executive  will  allow  several  independent 
processes  to  execute,  apparently  simultaneously,  on  the  same  processor. 

Here  is  another  area  that  one  gains  utility  and  ease  of  development  at  the 
possible  expense  of  run-time  efficiency. 
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The  escape  system  software  design  could  be  facilitated  by  use  of  a 
real  time  executive,  or  by  multitasking  features  as  incorporated  in  the  Ada 
language  specification.  It  is  likely,  however,  that  the  overhead  incurred 
would  be  unacceptable.  The  time  required  to  perform  a  task  swap,  that  is, 
to  save  the  status  of  a  process  executing  on  the  machine,  find  a  process 
that  is  eligible  for  execution,  and  initiate  it,  can  consume  several 
hundred  to  several  thousand  machine  instructions  or  cycles.  A  task  swap 
may  therefore  require  a  substantial  portion  of  a  millisecond.  It  would  be 
best  to  perform  event  detection  and  sequencing  directly  from  interrupt 
level  software.  The  only  remaining  processing  is  the  cyclic  controller 
algorithm,  which  can  be  initiated  by  a  single  interrupt.  Therefore  the 
escape  system  can  be  characterized  as  one  that  requires  a  simple  but 
efficient  real  time  software  design.  For  these  reasons  it  is  anticipated 
that  only  a  minimal  real  time  executive  will  be  required,  or  that  a  very 
simple  one  will  be  developed  specifically  for  the  application. 

5.4.6  Architecture  Trade  Study.  Based  on  the  observations  in  the 
preceding  sections.  Tables  5.1  and  5.2  give  the  results  of  a  tradeoff 
between  specific  configurations,  (Table  5.1)  and  general  architectures 
(Table  5.2).  The  weighting  factors  are  based  on  arguments  presented  above. 
The  table  entries  are  essentially  quality  factors  between  0  and  1  that 
essentially  rank  order  each  system  with  1  as  "best."  The  values  are 
otherwise  somewhat  subjective,  particularly  in  Table  5.2,  where  a 
particular  architecture  class  may  have  very  dissimilar  representat ive 
members. 

Table  5.1  the  specific  example  systems  described  in  the  preceding 
subsection.  The  reliability  and  performance  quality  factors  are  based 
directly  on  that  discussion.  As  to  the  architectural  classification  of  the 
five  systems,  the  first  four  are  essentially  uniprocessor  designs  with 
differing  types  of  failure  detection  and  management,  and  the  fifth  is 
either  a  federated  processing  system  or  a  distributed  system  depending  on 
the  implementation  details.  (Again,  the  terminology  used  here  is  taken 
from  AFWAL-TR-8 1-3 12(1.) 

Table  5.2  compares  the  general  processor  classes.  The  federated 
processor  and  distributed  processor  classes  are  essentially  equivalent  in 


Table  5.2 


every  area  save  development  risk.  This  is  due  to  the  fact  that  the  major 
architectural  difference  between  them  is  that  while  they  both  distribute 
processing  among  resources  in  a  fixed  way,  the  federated  system  need  not 
have  identical  processors,  but  may  use  processors  tailored  to  the  task,  or 
even  use  an  already  developed  subsystem  as  a  processing  resource.  An 
example  of  this  might  be  the  use  of  an  existing  attitude/heading  reference 
subsystem  with  its  own  processor  as  an  element  of  a  control  system. 

The  multiprocessor  distinguishes  itself  from  the  rest  by  having  the 
capability  to  dynamically  assign  processing  tasks  to  resources,  potentially 
improving  reliability.  This  is  achieved  at  the  expense  of  operating  system 
overhead  reducing  potential  throughput,  and  increased  development  risk. 

The  uniprocessor  architecture  provides  the  baseline  for  best 
volume/mass/ power  and  least  development  risk. 

The  reader  is  cautioned  that  when  interpreting  these  results  one  must 
keep  in  mind  that  a  good  system  design  may  well  make  use  of  more  than  one 
type  of  architectural  feature  to  accomplish  the  task  at  hand. 

Overall,  it  appears  that  the  simpler  systems  fare  well  in  comparison 
with  the  more  complex  systems,  but  at  this  level  of  investigation  no  single 
decisive  architectural  feature  can  be  identified. 

5.4.7  Vax-Tektronix  8550  10  Design.  This  subsection  documents  the 
design  of  the  I/O  interface  and  the  general  overall  design  of  the  MC68000 
control  software  development.  Further  details  are  to  be  found  in  Volume  II, 
Chapter  6,  It  was  decided  initially  (prior  to  the  amendment  of  Task  4, 
which  then  specified  real  time  development)  that  fidelity  of  simulation  was 
more  important  than  real  time  simulation.  This  resulted  in  the  following 
approach:  Simulation  software  executing  on  the  Vax  was  to  supply  simulated 

sensor  data  to  the  Tektronix  8550  emulating  the  68000.  The  68000  would 
execute  the  control  software  to  calculate  the  control  commands  that  would 
be  transmitted  to  the  escape  system.  The  execution  of  this  software  would 
be  timed  for  analysis  of  throughput  requirements.  The  commands  would  be 
transmitted  to  ttie  Vax,  which  would  simulate  the  actuators,  ejection  seat 
dynamics,  and  sensors,  and  the  process  would  repeat.  The  T/O  interface  to 


be  used  was  the  RS-232  serial  interface  already  available.  The  overall 
simulation  would  not  run  in  real  time,  due  to  the  simulation  and  l/O 
delays,  but  would  still  provide  a  facility  for  performing  timing  analysis 
and  prototypic  software  development. 

Development  of  several  low  level  I/O  routines  was  necessary  to  support 
the  emulation,  test  and  debug  of  Pascal  code  on  the  8550.  The  low  level 
I/O  routines  were  required  to  support  standard  Pascal  I/O  and  pointer 
management  on  the  Tektronix  8550  MDL.  The  routines  were  written  in  C  and 
added  to  the  the  Whitesmith's  C  and  Pascal  cross  compiler  support  library. 
The  routines  are  transparent  to  the  Pascal  user  and  support  only  standard 
Pascal  10.  With  this  initial  step  completed  the  Vax-Tektronix  8550  10 
interface  development  proceeded  as  documented  below. 

The  following  pseudo  code  (Tables  5.3  to  5.6)  describes  the  10 
protocol  between  the  Vax,  which  simulates  the  escape  system  sensors, 
system,  and  actuators,  and  the  Tektronix  8550  M68000  emulator  running  the 
control  algorithm.  The  transfers  are  ASCII  format  over  the  the  RS-232C 
remote  10  interface  between  the  Vax  and  the  8550. 

The  ASCII  format  was  chosen  because  it  is  readable  by  a  human,  it  is 
as  standard  and  available  an  interface  as  currently  exists,  and  is  the  only 
interface  reasonably  supported  by  standard  Pascal.  These  qualities  ensure 
portability  and  quick  implementation.  The  single  disadvantage  is  slow 
speed,  as  the  same  serial  TO  port  could  transfer  the  data  in  less  than  half 
the  time  if  it  were  in  binary  format.  Since  only  the  controller  execution 
will  be  timed  for  subsequent  analysis,  this  disadvantage  is 
inconsequential.  The  protocol  defined  by  the  pseudo  code  is  not  specific 
to  this  format  as  the  same  algorithm  is  suitable  for  binary  transfers  as 
well . 

This  interface  simulates  the  digital  or  serial  10  interface  that  will 
be  required  between  the  controller,  sensors  and  effectors  in  an  operational 
system. 

A  run  is  initiated  by  the  operator  at  the  Tektronix  8550.  Using  the 
8550  'comm'  command,  the  8550  is  established  as  a  terminal  communicating 


with  the  Vax  over  the  8550' s  remote  TO  interface  (serial  RS-232C).  Then, 
using  the  Vax  'RUN'  command,  the  VaxIO  procedure  is  brought  into  execution, 
VaxTO  transmits  an  information  message  to  the  operator  and  performs  a  read 
on  the  remote  10  interface. 

The  operator  may  abort  VaxIO  at  this  stage  by  typing  an  illegal 
message  or  an  abort  message,  or  he  may  simulate  a  normal  run  by  typing 
start  up  and  normal  transfer  messages  to  the  Vax.  (This  is  useful  for  test 
and  debug  purposes  and  would  not  be  possible  with  a  binary  transfer 
format) . 

A  normal  simulation  precedes  when  the  operator  exits  the  'comm' 
command  with  the  VaxIO  read  pending  on  the  remote  TO  interface.  The 
operator  then  uses  the  8550  'X'  (execute)  command  or  its  equivalent  to  run 
Control lertO  on  the  8550.  At  this  point,  VaxIO  is  functioning  as  a  slave 
and  ControllerlO  as  the  master.  ControllerlO  initiates  the  run  by  writing 
the  startup  message  to  the  remote  10  interface,  and  then  waits  for  the 
first  data  transfer  from  the  Vax  by  performing  a  read  on  the  remote  10 
interface.  Normal  transfers  between  the  Vax  and  8550  then  proceed  until 
either  processor  transmits  an  abort  message  to  the  other,  or  until 
ControllerlO  retransmits  the  startup  message  on  operator  request. 

Each  normal  transfer  contains  a  cycle  count  that  Is  incremented  by 
ControllerlO  on  each  transfer  to  the  Vax  and  is  subsequently  echoed  by  Vax 
in  the  transfer  from  the  Vax  to  the  8550.  The  cycle  count  is  allowed  to 
"roll  over"  before  it  reaches  a  predefined  magnitude  ( CycleModulus) .  The 
cycle  count  is  used  to  ensure  that  the  10  cransfers  precede  in  lock-step, 
witliout  a  missed  transfer.  The  cycle  count  may  also  be  interpreted  as  a 
t imetag . 


Note  that  VaxTO  and  ControllerlO  (Tables  5.3  and  5.4)  comprise  the 
main  routines  for  the  Vax  ejection  system  simulator  and  the  M68000 
controller  emulator,  respectively.  The  transfer  scheme  at  this  level  is 
single  rate.  A  multirate  control  system  can  be  implemented  in  this 
framework  by  appropriate  liigic  in  the  lower  level  routines  called  by  VaxTO 
and  ControllerlO. 


Table  5.3.  Vax  I/O  Procedure 


procedure  VaxIO; 
const 

CycleModulus  =  1000; 

var 


Initialized  :  boolean;  Indicates  receipt  of  start  message 
Done  :  boolean;  Indicates  completion  of  processing 

ExpectCycleCount  :  0. .CycleModulus-1 ;  Count  expected  next 
begin 

Initialized  :=  false; 

ExpectCycleCount  :=  0; 

Transmit  Information  message; 

repeat  Main  Processing  loop 
Read  controller  message; 


if  ioError  then  begin 

Transmit  abort  message; 

Done  :=  true 
end 

else  if  abort  message  received  then  begin 
Done  :=  true 

end 

else  if  start  message  received  then  begin 
Initialize  escape  system  state; 

Initialized  :=  true; 

Compute  initial  sensor  outputs; 

Transmit  cycle  count  and  sensor  outputs  to  controller; 
ExpectCycleCount  :=  received  cycle  count; 

Done  :=  false 

end 

else  if  received  cycle  count  <>  ExpectCycleCount  then  begin 
Transmit  abort  message; 

Done  :=  true 

end 

else  if  not  Initialized  then  begin 


Transmit  abort  message; 
Done  ;=  true 


end 


end 

else  begin  normal  cycle  processsing 

Compute  actuator  response,  escape  system  state, 
and  sensor  outputs  from  previous  state  and 
controller  commands; 

Transmit  cycle  count  and  sensor  outputs  to  controller 
Done  :=  false; 

end; 

Increment  ExpectCycleCount  mod  CycleModulus 
until  Done; 

Print  termination  conditions  at  operator  console  if  abnormal 
{  VaxIO  } 
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Table  5. A.  MC68000  (controller)  10  procedure 


procedure  ControllerlO; 
const 

CycleModulus  =  1000; 


var 


CycleCount  :  0. 
Done  :  boolean; 


.CycleModulus-1 ; 

Indicates  completion  of  processing 


begin 


repeat 

Initialize; 

Done  :=  false; 

CycleCount  :=  0; 

Transmit  startup  message  and  initial  CycleCount; 

Read  initial  sensor  outputs  (from  Vax) ; 

while  not  (  abort  message  received 
or  ioError 

or  received  cycle  count  <>  CycleCount 
or  Done  )  do  begin 

Increment  CycleCount  mod  CycleModulus; 

Start  digital  timer; 

Compute  controller  outputs  from  sensor  outputs  received; 
Record  computation  time  for  analysis; 

Set  Done  as  required; 

Transmit  CycleCount  and  controller  commands; 

Read  sensor  outputs  (from  Vax) 


print  termination  condition 
until  operator  requests  termination  of  run 

end; 


Table  5.5.  10  Transfer  Formats 


In  what  follows,  read  as  ’is  defined  as*. 

Single  quotes  indicate  a  literal  occurence  of  the  enclosed 
symbol,  and  the  vertical  bars  "j  '  separate  optional  forms 
of  which  one  must  occur.  Curly  braces  ' i  i '  denote  zero 
or  more  occurences  of  the  enclosed  object.  Symbols  and 
numbers  are  separated  by  one  or  more  blanks,  tabs,  line 
feeds,  or  carriage  returns. 


message  : :=  start-up-message 
I  abort-message 
I  normal-transfer 

start-up-message  : ’S'  cycle-count  ’.’ 
abort-message  : ’A’  abort-code 
normal-transfer  ’N’  cycle-count  data  *•' 
cycle-count  : :=  unsigned  integer  mod  CycleModulus 
abort-code  ::=  signed  integer 


data  ; ;=  signed  integer 


Table  5.b.  Examples 


Start  up  message  (controller  to  Vax) : 

S  000  . 

The  'S'  indicates  that  this  is  a  start-up  message, 
and  the  initial  cycle  count  is  zero. 

Abort  message: 

A  -1  . 


The  'A'  indicates  an  abort  initiated  by  the  sender, 
the  '-1*  indicates  the  type  of  abort  (a  cycle  count 
mismatch,  for  example). 

Normal  message: 

N  056 

100  120  35 
-56  -34  500 
67 
98 


In  the  above  the  'N'  Indicates  a  normal  data  transfer 
with  a  cycle  count  of  56,  followed  by  data.  The 
definition  and  scale  factors  of  the  data  depend  apon  the 
sender.  Symbols  and  numbers  may  be  separated  by  one  or  more 
blanks,  tabs,  line  feeds,  or  carriage  returns. 


5,5  Control  System  Components  Tradeoff  Analysis. 


In  this  section  we  analyze  the  relative  strengths  and  weaknesses  of 
the  major  control  system  hardware  components,  with  respect  to  the  ejection 
seat  requirements.  The  hardware  is  divided  into  three  categories: 
sensors,  controller  hardware  (including  microprocessors),  and  energy 
sources.  These  categories  neglect  other  important  components,  such  as 
restraint  systems  but  these  are  felt  at  this  time  not  to  be  critical 
elements  for  the  actual  control  system  design.  The  total  control  system  is 
considered  to  consist  of  the  sensors,  the  control  logic  and  sequencing  unit 
(microprocessorC s) ) ,  the  thrust  actuators,  and  the  power  supplies.  The 
latter  will  not  be  discussed  further  here  beyond  pointing  out  that  TLX 
signal  actuating  redundant  thermal  batteries  are  probably  still  the  best 
type  for  ejection  seat  use. 

The  goal  of  this  section  is  to  compare  and  assess  leading  candidates 
in  each  category  according  to  key  criteria,  and  indicate  preferences  based 
on  simulation  requirements  of  the  control  system,  and  manufacturer's  data 
sheets.  All  hardware  is  assumed  capable  of  performance  to  the  stated  specs 
of  the  manufacturer.  Performance  as  an  integrated  component  cannot,  of 
course,  be  evaluated  at  this  time. 

Another  aspect  is  that  manufacturers  have  to  date  not  directed  the 
application  of  their  products  to  use  on  ejection  seats.  Thus,  it  will 
happen  that  several  items  each  have  many  attractive  features  for  seat 
control,  but  the  ideal  component  will  be  a  mix  of  state-of-the-art  designs. 
Excessive  "customizing"  for  seat  use,  however,  could  lead  to  unacceptable 
production  costs. 

The  trade  studies  are  presented  primarily  by  means  of  "decision" 
matrices.  These  have  been  developed  for  each  group  of  hardware  components, 
e.g.,  angular  accelerometer,  and  run  to  two  or  three  levels.  As  best  as 
possible,  weights  and  figures  of  merit  have  been  related  to  anticipated  use 
of  the  design  or  component  in  the  SSI-developed  control  system.  Thus,  for 
example,  angular  rate  sensing  is  not  as  important  for  our  system  as  angular 
acceleration  sensing,  so  that  performance  for  rate  gyros  is  not  weighted  as 


highly  as  performance  for  angular  accelerometers.  As  another  example,  a 
three-axis  sensing  package  whose  volume  exceeds  that  of  an  equivalent 
sensor  will  nonetheless  score  higher  if  the  latter  has  fewer  input  axes, 
and  if  that  results  in  a  net  greater  volume  for  the  number  of  such  devices 
needed  to  provide  data  for  the  three  axes  needed  by  the  controller. 

It  is  expected  that  the  sensing,  control,  propulsion,  and  ejection 
seat  communities  will  provide  further  input  into  the  selection  of  weighting 
factors  and  relative  figures  of  merit. 

Microprocessor  architecture  and  related  issues  were  discussed  in 
Sections  5.3  and  5.4.  Section  5.5.1  will  discuss  sensor  hardware  trade 
analysis.  Section  5.5.2  will  discuss  energy  source  and  actuation  hardware 
trade  analysis,  and  Section  5.5.3  will  summarize  and  present  our 
r ecommendat ions . 

5.5.1  Sensor  Hardware.  In  this  analysis,  we  discuss  several  types  of 
sensors  which  may  be  practical  in  providing  necessary  inputs  for  ejection 
seat  control  systems.  The  sensors  are  required  to  provide  state  variable 
information  for  the  controller.  The  Information  most  important  for  the  SSI 
controller  is:  linear  and  angular  acceleration,  attitude,  and  altitude. 
Independent  sensing  of  dynamic  pressure,  airspeed  and  wind  direction  would 
greatly  help,  and  independent  sensing  of  angular  rate,  inertial  velocity 
and  density  or  temperature  would  be  useful  for  redundancy  purposes.  The 
number  of  such  devices  which  can  be  accommodated  is  a  packaging  tradeoff 
with  control  system  performance  and  capability. 

The  sensor  categories  selected  for  the  trade  analysis,  then,  are 
accelerometers,  angular  ■ ccelerometers,  air  data  sensors,  pressure  sensors, 
att Ltude/alt itude  sensors,  and  angular  rate  sensors.  The  grouping  has  been 
dictated  by  the  general  trend  in  the  product  lines,  although  there  is  some 
overlap.  Depending  on  the  specific  system,  an  air  data  sensor  may  provide 
altitude  Information,  and  a  radar  altimeter  system  could  supply  both 
attitude  and  altitude.  The  figures  of  merit  and  weights  have  been  selected 
with  such  factors  in  mind. 

There  are  two  levels  of  decision  matrix  for  the  sensor  hardware,  in 
each  of  the  above  six  sensor  categories.  The  lowest  level  establishes 
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overall  performance  ratings,  and  the  performance  criteria  producing  this 
rating  are:  sensitivity  range,  start-up  time,  tolerable  acceleration 
environment,  operating  temperature,  frequency  response,  accuracy, 
hysteresis  characteristics,  resistance  to  Impact,  complexity  (number  of 
moving  parts),  and  sensitivity  to  EMI/EMP  effects. 

The  top  level  decision  matrix  for  each  sensor  category  includes  the 
following  design  criteria:  performance,  reliability,  weight,  size 
(volume),  power  requirement,  development  risk,  auxiliary  hardware 
requirements  (e.g.,  A/D  converters  or  amplifiers),  ease  of  maintenance, 
safety,  interface  compatibility,  and  development  and  production  cost. 

As  is  also  the  case  with  the  propulsion  system  trade  study  (Subsection 
5.5.2),  the  nature  of  this  project  leads  to  different  weights  than  might  be 
found  in  a  more  developmental  project.  Performance  here  is  weighted  much 
higher,  for  example,  and  production  and  development  costs  are  weighted  very 
low. 


For  the  sensor  trade  analysis  presented  in  this  section,  the  top  level 
weighting  factors  may  vary  from  one  sensor  category  to  the  next;  however, 
at  the  lower  level,  the  weights  are  the  same,  for  each  criterion  (e.g., 
start-up  time).  The  figures  of  merit  for  specific  components  are  scaled 
between  O.l  and  0.9.  If  a  product  Is  seen  to  be  adequate  for  any 
conceivable  seat  application,  it  will  get  a  score  of  0.9,  even  if  another 
product  is  better  in  this  criterion. 

We  now  give  an  overview  of  the  reasoning  for  the  inclusion  of  certain 
of  the  performance  and  design  criteria. 


It  was  stated  above  that,  for  an  exploratory  development  project, 
performance  is  most  important.  Also  very  important  are  weight  and  volume, 
which  indirectly  affect  performance  (it  can  be  argued  that  weight  is  itself 
a  performance  criterion).  Current  operational  seats  have  very  small 
latitude  for  the  inclusion  of  a  new  set  of  hardware,  such  as 
microprocessors  and  sensors.  Although  next  generation  seats  will  likely 
involve  extensive  redesign,  all  designs  must  have  retrofit  capability  into 
existing  aircraft.  Thus,  the  size  or  "packaging"  issue  is  a  very  real  one, 
and  it  produces  severe  constraints. 
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Another  packaging  issue  is  that  manufacturers  have  not  yet  integrated 
sensor  electronics  with  microprocessor  bit  and  bus  structures.  They  are 
little  to  be  blamed  for  this,  since  common  digital  standards  do  not  exist 
yet.  However,  since  the  Air  Force  is  developing  one  for  its  aircraft,  it 
is  a  good  opportunity  to  stress  sensor  integration  for  ejection  seat  and 
similar  applications.  For  the  present,  interfacing  is  left  to  the 
customer. 

Closely  related  to  the  size  criterion  in  terms  of  retrofit  capability 
is  cost.  This  is  always  important,  but  even  more  so  for  seats;  this 
should  be  kept  in  mind,  although  we  are  not  weighing  cost  too  heavily  for 
the  scope  of  our  project.  Today's  operational  seats  cost  $60  to  $100K  in 
current  dollars,  and  do  not  have  the  sophisticated  technology  being  planned 
for  the  next  generation.  A  new  design  which  more  than  doubles  the  unit 
cost  of  a  seat  will  probably  not  be  used  extensively.  In  this  regard,  many 
of  the  state-of-the-art  (SOA)  components  have  a  cost  factor  related  to 
design  and  performance  features  which  aren't  critical  for  operation  of  the 
ejection  seat.  It  is  important  to  recognize  and  avoid,  if  possible, 
situations  in  which  most  of  the  cost  is  for  unneeded  features  and/or 
performance. 

Another  factor  is  that  the  main  seat  structural  mode  usually  falls 
within  the  bandwidth  (sensitivity  range)  of  many  sensors,  such  as  rate 
gyros.  This  type  of  problem  can  be  eliminated,  for  example  by  using  notch 
filters,  but  the  designer  must  be  aware  of  it. 

Complexity  and  ruggedness  are  two  criteria  which  can  be  considered 
reliability  fa<'tors.  In  the  crew  escape  application,  extreme  accuracy  of 
measurements  is  usually  less  important  than  being  guaranteed  a  measurement 
of  some  minimal  accuracy.  Due  to  the  very  short  operational  duration,  such 
specifications  as  drift  rates,  null  offsets,  etc.  are  not  critical. 

However,  the  unit  must  be  capable  of  successful  s* artup  and  operation, 
after  long  periods  and  conditions  of  storage,  and  during  all  of  the 
anticipated  operational  conditions  of  vibration,  shock,  temperature 
variation,  etc.  Thus,  while  the  system  as  a  whole  is  to  be  much  more 
sophisticated,  the  emphasis  for  most,  if  not  all,  of  the  key  control  system 


components  is  on  reliability.  This  implies  in  many  cases  foregoing 
complexity  and  sophistication  for  simplicity. 

As  a  final  introductory  note,  there  is  a  tradeoff  between  control 
system  performance  and  the  type  and  number  of  sensors  which  will  comprise 
the  system.  A  minimal  number  of  sensors  will  place  a  greater  strain  on 
microprocessor  resources,  as  quantities  not  directly  measured  will  have  to 
be  estimated  by  computer.  On  the  other  hand,  seat  geometry  and  weight 
limitations  will  force  a  conservative  selection  of  sensors. 

The  rest  of  this  section  is  devoted  to  an  analysis  of  candidate  sensor 
hardware.  We  have  tried  to  examine  as  broad  a  spectrum  of  concepts  and 
mechanizations  as  possible.  Appendix  E  contains  some  specification  sheets 
of  components  discussed  here,  which  we  were  able  to  obtain.  Attitude 
sensors  include  microwave  radiometers,  directional  gyros,  strapdown  gyros 
and  fluidic  platforms.  Attitude  rate  sensors  include  rate  gyros,  fluid 
rate  sensors,  angular  accelerometers,  strapdown  gyros,  and  vibratory  rate 
sensors.  Accelerations  will  be  sensed  using  linear  accelerometers. 

5. 5.1. 1  Attitude  Sensors.  Attitude  can  be  measured  by  either 
electronic  or  fluidic  systems.  This  section  analyzes  some  likely 
candidates,  from  the  standpoint  of  our  particular  control  design,  and  of 
the  system  operational  requirements. 

Microwave  Radiometer  Attitude  Sensing.  A  microwave  radiometer  can 
antenna  is  aimed  toward  the  zenith  (at  its  desired  orientation)  and  the 
others  are  in  the  horizontal  plane.  Under  the  desired  conditions  the 
vertical-looking  antenna  will  record  cool  temperatures,  while  the 
horizontal-looking  antennas  will  see  uniformly  warmer  temperatures. 

Because  of  symmetry,  only  pitch  and  roll  information  will  be  available. 

This  passive  radiometer  system  could  consist  of  hardware  such  as  AEI, 
H6100  horn  antennas  with  40  degree  beam.  Microwave  Associates  MA8430  solid 
state  selector  switch  and  a  Honeywell  R15-V  receiver.  Total  weight  would 
be  less  than  three  pounds  total  cost  about  $6000,  and  total  power 
consumption  of  less  than  60  watts.  Although  a  similar  system  has  been 
demonstrated  by  the  Navy,  the  weight  and  size  pose  operational  problems  for 


sLate-of-the-arL  systems.  However,  the  basic  state-of-the  art  exists  for 
such  systems,  and  a  development  effort  geared  to  ejection  seat  applications 
does  not  represent  a  major  advance  in  the  technology.  It  is  expected  that 
both  weight  and  power  can  be  greatly  reduced.  The  significant  remaining 
concerns  are  temperature  control  of  the  receivers,  and  the  fact  that  this 
system  does  not  measure  altitude. 

Directional  Gyro.  Directional  gyros  are  used  typically  to  provide 
vertical  or  heading  reference  and  represent  a  fairly  mature  technology. 

They  are  two-degree-of-f reedom  mechanical  devices  whose  gimbal 
displacements  about  each  output  axis  constitute  a  measure  of  angular 
deviation  from  the  desired  direction. 


One  example  is  the  vertical  gyro  used  to  measure  deviations  from  local 
vertical.  Two  accelerometers  are  orthogonally  mounted  on  a  platform  whose 
desired  orientation  is  horizontal.  In  steady-state  (one  g)  conditions  the 
accelerometers  measure  deviations  from  local  vertical  and  "slave"  the 
gimbal  assembly  to  the  local  vertical.  During  dynamic  conditions  the 
accelerometers  would  give  erroneous  information;  therefore,  they  are  cut 
out.  As  a  result,  the  local  vertical  during  maneuvers  will  drift  at  the 
drift  rate  of  the  gyros  (typically  10  to  15  deg/hr). 

One  problem  with  this  system  is  the  possibility  of  gimbal  lock  since 
this  is  restricted  motion  about  the  inner  gimbal.  This  may  be  avoided  by 
adding  a  third  gimbal  with  a  fast  erection  loop  around  the  two  inner 
gimbals . 

Starting  time  is  about  0.25  sec,  so  the  system  must  be  kept  in  an 
operating  state  continuously.  This  could  be  done  concurrently  with  the 
erection  of  the  aircraft's  guidance  sensors.  If  utilized  on  the  seat, 
power  may  he  turned  off  at  ejection,  since  gyro  wheels  will  not  lose 
•s  igni  f  leant  angular  momentum  for  several  minutes. 

Timex  manufacturers  an  interesting  displacement  gyro  which  has  some 
attractive  features.  It  is  a  2-axis  gyro  which  is  gas-activated, 
el  iminating  the  need  for  motors  and  associated  electronics.  Warm-up  and 
uncaging  takes  place  within  250  msec.  This  is  a  marginal  startup  time  for 
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seat  applications,  but  Improvement  may  not  present  major  obstacles.  The 
device  can  operate  for  up  to  20  seconds  and  has  been  used  for  anti  tank 
missiles.  Since  the  device  is  giraballed,  gimbal  lock  can  occur;  one 
gimbal  has  full  360  degree  freedom,  while  the  other  is  limited  to  about  70 
degrees.  Weight  is  11  ounces,  volume  is  about  4  cubic  inches  (including 
gas  supply),  and  cost  is  $500.  Output  is  two  angles,  measured  directly. 
These  specifications  are  favorable  for  ejection  seat  use,  although  two 
units  are  needed  for  three  axis  coverage  (one  of  the  three  axes  will 
receive  redundant  measurements  -  a  third  unit  could  be  added  for  full 
redundancy,  but  total  size  and  weight  become  greater  concerns).  The  device 
is  rated  up  to  400  g  shock  and  will  handle  angular  rates  up  to  200 
degrees/sec.  The  total  error  is  about  one  degree  in  15  seconds. 

The  rate  sensing  range  is  currently  not  adequate  for  ejection  seat 
applications,  where  rates  up  to  1000  degrees/ sec  have  been  observed,  even 
during  initial  phases  of  a  controlled  escape.  Unless  the  design  can  be 
"customized"  to  meet  this  need,  this  particular  unit  will  not  be 
acceptable. 

Strapdown  Gyro.  Strapdown  systems  generally  come  in  two  major 
categories;  (1)  inertial  and  (2)  attitude  and  heading  reference.  The 
former  uses  a  higher  grade  gyro  than  is  required  for  our  purposes.  Thus, 
we  will  consider  only  the  less  sophisticated  and  cheaper  attitude  and 
heading  reference  systems. 

This  technology  is  more  than  twenty  years  old  and  is  rather  mature. 

As  as  result,  even  the  simplest  systems  perform  at  a  level  which  should 
meet  all  of  our  requirements.  For  example,  attitude  accuracy  requirements 
are  no  more  than  about  10  degrees.  Attitude  systems  are  self-contained  and 
require  no  outside  intelligence.  This  is  a  very  important  consideration 
for  ejection  seats,  which  should  be  totally  free  of  dependence  on  the 
aircraft  avionics. 

Types  of  gyros  used  in  present  day  systems  include  laser-driven, 
dry-tuned,  f luided-f loated  and  even  angular  accelerometer  with  integration. 
An  angular  accelerometer  can  thus  provide  both  acceleration  and  rate 
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Information,  greatly  reducing  system  size  and  complexity.  Laser-driven 
systems  are  still  in  the  development  stage  and  are  quite  expensive. 
Dry-tuned  or  floated  gyros  take  several  seconds  to  come  up  to  speed,  so 
must  be  turned  on  before  ejection.  Dry-tuned  gyros  appear  more  practical 
for  ejection  seat  applications.  This  system  would  be  aligned  prior  to 
flight  and  remain  powered  during  the  flight. 

If  the  decision  is  made  to  ’’live  with"  the  pre-ejection  start  up  needs 
of  inertial  sensors,  then  the  system  can  be  periodically  given  an  attitude 
reference  from  the  main  aircraft  avionics  system.  The  rate  of  update  is 
related  to  the  drift  rate  of  the  seat  sensors;  since  these  would  he  a 
lower  grade,  due  to  reduced  performance  needs  in  this  area,  the  drift  rate 
would  perhaps  require  an  update  every  5  or  10  minutes.  Between  updates, 
the  system  is  tracking  the  seat's  attitude  variations. 

Strapdown  systems  consist  of  two  major  parts,  a  sensor  package  with 
associated  electronics  and  a  digital  computer  for  performing  the  required 
strapdown  calculations.  One  present  system  used  for  a  torpedo  uses  no 
forced  air  cooling  and  the  entire  system,  including  sensors,  power  supplies 
and  electronics  are  all  in  a  box  that  weighs  six  pounds.  All  strapdown 
calculations  are  performed  in  the  same  unit. 

Such  systems  require  some  modification  prior  to  ejection  seat  use, 
particularly  in  the  area  of  weight,  size  and  power  reduction.  Data 
processing  can  be  performed  by  the  controller  microprocessor;  however, 
utilization  of  raw  data  from  a  strapdown  system  usually  costs  300  to  500 
KOPS  in  machine  capacity. 

The  strapdown  attitude  reference  system  is  attractive  in  several  ways 
for  application  to  ejection  seat  control.  Because  it  contains  rate 
integrating  gyros,  rates  can  be  picked  off  and  separate  rate  sensors  for 
the  control  system  are  not  required. 

A  three-axis  strapdown  rate  assembly  was  tested  for  use  in  the  B-1 
ejectable  crew  model.  The  rate  gyros  were  spring-restrained,  employed  a 
compensated  damping  mechanism  and  were  operated  both  during  pre-ejection 
and  ejection  phases.  The  CR-C5  gyro  (Northrop  Precision  Products  Division) 
was  employed,  which  has  the  following  characteristics  shown  in  Table  5. 
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TABLE  5.7  NORTHROP  GR-G5  GYROSCOPE 


input  range 
vibration 
acceleration 
shock 

temperature 
rms  bias  error 

rms  scale  factor  error 
rms  linear  acceleration- 
sensitive  error 
rms  angular  acceleration- 
sensitive  error 


360  deg/ sec 
20  g;  20-2000  Hz 
40  g,  any  direction 
300  g/7  msec 

-80  deg  (F)  to  +203  deg  (F) 

0.9  deg/sec  (resolution  hysteresis  + 
nonlinearity) 

0.5% 

O.I  deg/sec/g 

0.0005  deg/sec/deg/sec**2 


Model  GR-G5  has  been  used  in  tactical  missiles  such  as  the  Maverick, 
Sparrow  and  SRAM,  as  well  as  the  F-16  autopilot.  It  weighs  4  ounces, 
occupies  about  2  cubic  inches  and  costs  less  than  $900.  Maximum  angular 
rate  is  600  deg/sec  and  the  environmental  limits  are  10  g  rms/20-2000  Hz 
for  vibration  and  100  g/11  msec  for  shock.  The  error  characteristics  are 
0.05  /sec/g  mass  unbalance,  and  0.10  /sec  in  null  stability.  This 
instrument  could  be  used  on  the  ejection  seat  without  major  problems, 
particularly  if  production  per  unit  costs  can  be  reduced. 

Northrop  Precision  Products  Division  manufactures  a  rate  integrating 
strapdown  gyro.  Model  GI-G6,  which  weighs  4  ounces,  occupies  about  2  cubic 
inches  and  costs  $2000.  Other  specifications  are  10  g  rms/20-2000  Hz 
vibration,  and  100  g/ll  msec  shock.  Total  drift  error  would  be  less  than  1 
degree/minute  for  expected  ejection  seat  maneuvers. 


Radar  Altimeter.  These  devices  offer  great  potential  for  ejection 
seat  use;  however,  there  are  some  problems  to  be  dealt  with. 

The  technology  is  well  established;  there  is  only  the  need  to  apply 
it  to  ejection  seats.  These  devices  use  LSIC  or  gate  arrays.  They  are 
rugged,  good  at  low  altitude,  and  can  be  configured  to  provide  attitude 
information  as  well.  This  would  be  a  packaging  benefit.  Tf  a  sufficiently 
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large  commitment  for  development  were  made,  the  devices  could  be  reduced 
greatly  in  size  and  weight.  There  is  also  a  need  for  comprehensive 
analysis  to  determine  the  optimum  beam  width  and  operating  frequency  for 
seat  use.  This  is  due  in  part  to  the  fact  that  the  aircraft  interferes 
with  the  beam  in  its  efforts  to  locate  the  ground.  The  problem  is 
solvable,  however.  The  tracker  can  acquire  within  a  few  msec,  which  is 
much  faster  than  most  comparable  devices. 

Fluidic  Platform.  At  this  time  the  principal  developmental  challenge 
is  maintenance  of  accuracy  over  the  required  temperature  range.  This  may 
require  Reynolds  number  control. 

Results .  Tables  5.8  and  5.*)  present  the  results  of  the  trade  analysis 
performed  on  attitude/altitude  systems.  With  all  factors  considered,  as  we 
have  weighted  them,  the  radar  altimeter  offers  the  best  option  for  ejection 
seat  purposes.  This  is  in  part  true  here  because  we  are  not  weighing 
development  costs  very  high.  This  aspect  also  benefits  the  strapdown 
system  relative  to  fluidic  platforms.  The  former  benefits  from  its  proven 
technology,  which  tends  to  offset  a  performance  disadvantage  with  respect 
to  the  fir;  ;'c  platform.  Final  ranking  properly  awaits  specific 
development  for  seat  use. 

5. 5. 1.2  Attitude  Rate  Sensors.  Attitiide  rate  sensors  being 
considered  are  rate  gyros,  fluidic  rate  sensors,  (integrating)  angular 
accelerometers ,  strapdown  gyros,  and  vibration  rate  sensors. 

Rate  Gyro.  The  conventional  rate  gyro  !s  a  device  with  a 
constant-speed  wheel  which  establishes  an  angular  Momentum  vector  and 
resultant  spin  reference  axis.  The  wheel  is  typically  contained  in  a 
cylindrical  chamber  (float)  which  is,  in  turn,  suspended  in  a  viscous 
damping  fluid.  The  float  is  constrained  to  rotate  about  an  output  axis 
which  is  orthogonal  to  the  spin  reference  axis.  Rotation  angle  of  tne 
float  depends  upon  the  spring  rate  of  a  torsion  bar,  and  is  measured  by  an 
electromagnetic  pickoff. 

Because  of  their  small  size  and  versatility,  rate  gyros  are  the  most 
widely-usc^d  devices  for  rate  sensing  in  the  cf)ntrol  field  and  are  a  mature 
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technology.  MTBF’s  (Mean  Time  Between  Failure)  of  20,000  hours  are 
realized  with  present  systems.  Due  to  warm-up  times  of  20  seconds  or  more, 
they  would  have  to  be  turned  on  for  the  entire  flight.  This  requirement 
makes  them  less  appealing  as  a  group  than  fluidic  rate  sensors.  Other 
"problems"  with  respect  to  other  devices  such  as  fluidic  rate  sensors  are 
that  these  systems  usually  cannot  tolerate  20  g  shocks  (spin  motor 
bearings).  There  are  exceptions  listed  below,  however.  Also,  some  units 
require  much  power  (4  watts  or  so),  and  linearity  may  not  be  as  good 
(although  likely  adequate  for  seat  control). 

A  typical  representative  of  this  group  of  rate  sensors  is  the  Northrop 
GR-G5  rate  gyro.  Its  startup  time  is  30  sec,  which  requires  that  it  be 
running  continuously  while  the  aircraft  is  in  operation.  It  has  an  input 
range  of  +/-  360  deg/sec,  which  is  also  a  liability,  since  rates  up  to  1000 
deg/sec  can  happen.  Its  other  features  are  fine  for  seat  applications; 
very  light  (4.5  oz.),  good  temperature  range,  small,  and  can  operate  in  a 
40g  acceleration  field. 

A  better  candidate  in  terms  of  performance  is  the  Timex  TAG030  series. 
This  is  a  2  axis,  gas  activated  gyro  which  is  being  used  on  short  range 
tactical  missiles.  A  compressed  inert  gas  spins  the  rotor,  and  the  system 
can  operate  for  50  sec.  Two  such  units  would  be  needed  for  the  seat 
control  system.  The  unit  tends  to  be  large  (1.8  x  1.9  x  3.45  in.),  and 
weighs  8  oz.  It  is  inexpensive  (exact  cost  not  available),  and  can  be 
"customized".  The  TAG030  suffers  from  startup  times  also,  although  the 
time  has  been  greatly  reduced,  to  300  msec.  Reducing  the  rotor  mass  or 
increasing  the  gas  pressure  may  make  this  unit  a  good  choice.  Any  accuracy 
loss  arising  from  such  changes  is  a  worthwhile  tradeoff. 

Honeywell  offers  a  magnetohydrodynamic  rate  sensor  which  has  several 
good  features  for  seat  use.  The  GG2500  is  axis  sensor  (thus,  only  2 

unit  are  needed),  very  small  and  light,  with  e  temperature  range  and 

good  response  time.  It  is  rugged,  low  cf>st,  mec  >nlcally  simple  -  offeriin; 
excellent  reliability,  radiation  insensitive,  and  is  been  used 
successfully  in  related  applications  such  as  air  and  ground  launched 
missiles,  seekers  and  RPV's.  Its  major  drawback  at  this  time  is  the 


startup  time,  which  is  3.0  sec.  Development  is  needed  to  improve  this 
feature. 

Fluidic  Rate  Sensor.  Fluidic  Laminar  Rate  Sensors  (LARS)  are  based  on 
a  well-developed  fluidic  amplifier  technology.  A  typical  fluidic  amplifier 
consists  of  a  high  pressure  fluidic  supply,  amplifier  nozzle  and  a  jet 
splitter.  With  equal  control  pressures  on  at  two  oppositely-directed 
control  pressure  ports,  the  jet  divides  equally  across  the  splitter. 
Differential  pressure  at  the  two  ports  leads  to  a  higher  differential 
pressure  at  the  output  ports. 

In  a  LARS,  the  two  control  ports  are  not  required.  If  the  device 
rotates,  the  (inertial)  effect  is  to  divert  the  flow  to  one  side  of  the 
splitter.  However,  the  same  amplification  effect  still  operates,  giving  a 
sensitive  indication  of  angular  rate.  In  actual  practice,  control  ports 
are  sometimes  employed  for  trimming  of  null  offset. 

LARS  are  relatively  cheap,  can  come  on-line  quickly  (less  than  ten 
msec),  are  very  reliable  and  rugged  and  have  a  low  power  requirement. 
I.inearity,  null  affect  and  threshold  requirements  are  comparable  to 
electro-mechanical  rate  sensors  and  the  dynamic  range  is  about  1000 
deg/sec.  Finally,  this  device  has  no  moving  parts. 

A  more  expensive  alternative  to  LARS  is  the  super  jet  rate  sensor, 
which  uses  the  principle  of  Coriolis  acceleration  which  deflects  the  jet 
stream  in  the  presence  of  angular  velocity.  One  such  device,  used  in  a 
cannon  projective,  weighs  12  ounces  and  has  2'>,000  hr  MTBF.  Warm-up  time 
Is  1  .■)  sec,  so  that  this  system  is  not  practical  for  ejection  seat 
•cppl  icat  ions. 

An  interesting  unit  recently  tested  for  the  Air  Force  is  the 
S  ng(?r/Keartott  (ionfliict  ive  I>iquid  Angular  Rate  (CLAR)  sensor.  A  conductive 
liquid  (mercury  thallium)  annulus  In  the  gap  of  a  permanent  magnet  moves  in 
response  to  angular  motion,  and  its  conductivity  in  the  magnetic  field 
changes  in  a  measurable  way,  according  to  Lenz'  law.  It  is  a  single  axis 
sensor,  and  reqviires  no  external  power,  an  excellent  feature.  The  liquid 
freezes  at  -75  deg  ( F) ,  so  this  is  acceptable  as  well.  Tt  offers  high 


reliability,  low  cost  and  long  life.  Each  unit  is  somewhat  large  compared 
to  many  similar  units  (30  cubic  inches),  and  it  is  new  technology. 

In  our  opinion  the  most  attractive  rate  sensor  for  ejection  seat 
applications  will  have  performance  similar  to  the  Garrett  Airgyro.  This  is 
a  fluidic  rate  sensor  with  no  moving  mechanical  parts,  small  size,  low 
production  cost  (about  $1  per  laminate),  minimal  complexity,  and  very 
light.  It  has  exceptional  startup  specs  (2  msec),  acceptable  dynamic 
response  (over  50  Hz  bandwidth)  and  input  range,  and  minimal  hysteresis  or 
deadband  dynamics.  It  has  been  proven  successful  in  high-g  aerospace 
applications,  long  inaction  times,  and  is  insensitive  to  electromagnetic 
interference  or  pulses  (EMI,  EMP) .  The  Garrett  unit  has  electronic  or 
fluidic  interfacing. 

Vibratory  Rate  Sensor.  Vibratory  rate  sensors  use  an  oscillating 
inertial  body  constrained  to  a  base,  against  its  natural  tendency  to 
preserve  an  inertially-f ixed  base,  and  the  torque  associated  with  such 
constraint  is  taken  as  a  measure  of  the  base  rotational  velocity.  Two 
types  of  sensors  will  be  discussed  -  vibrating  wire  and  vibrating  beam 
types. 

The  vibrating  wire  rate  sensor  uses  a  vibrating  wire  as  its  inertial 
reference.  Equal  lengths  of  wire  are  joined  at  the  middle  and  each  half 
passes  through  mutually  orthogonal  planes.  Any  turning  rate  applied  to  the 
sensor  causes  the  wire  to  vibrate  in  an  elliptical  path  due  to  Coriolis 
forces,  crossing  the  perpendicular  flux  field  in  the  other  half  of  the  wire 
containing  the  signal  magnet.  The  resulting  signal  is  picked  off  and 
amplified.  One  current  system  consumes  less  than  one  watt,  has  a  warm-up 
time  of  O.l  sec  and  a  75,000  hr  MTBF. 

The  vibrating  beam  sensor  consists  of  a  rectangular  cross  section  beam 
supported  at  its  modal  points  and  driven  along  one  of  the  principal  axes  at 
its  fundamental  frequency.  When  an  angular  rate  is  applied  along  the 
beam's  longitudinal  axis,  sinusoidally-varying  Coriolis  forces  cause  motion 
of  the  beam  along  an  axis  normal  to  the  drive  axis.  This  orthogonal 
sinusoidal  motion  provides  the  sensor  output,  which  is  proport ii')nal  to  the 


input  rate.  System  reliability  is  not  high  enough  to  warrant  consideration 
for  ejection  seat  control. 

Results.  Tables  5.10  and  5.11  present  results  of  our  trade  analysis 
of  rate  sensors.  It  includes  some  devices  not  specifically  mentioned 
above.  Again,  final  rankings  depend  heavily  on  assigned  weightings.  The 
Honeywell  002500  scores  very  well  because  of  its  very  small  size,  and  Its 
multi-axis  design.  It  is  assumed  that  its  startup  problem  can  be  overcome 
with  development  expense,  not  weighted  heavily  here.  The  CLARS  sensor  is 
less  proven,  although  offering  much  promise,  and  it  may  lose  performance  if 
reduced  to  the  size  needed  for  seat  use,  due  to  physical  limitations.  We 
would  also  recommend  consideration  of  the  Delco  hemispherical  resonator 
gyro  (HRG). 

5. 5. 1.3  Angular  Accelerometers.  The  angular  accelerometer  is 
comprised  of  two  basic  elements  -  a  servoed  angular  accelerometer  and  a 
solid  state  integrator  with  automatic  washout.  It  operates  on  the 
force-rebalance  principle,  with  a  seismic  mass  that  tends  to  remain 
undisturbed  when  angularly  disturbed.  Relative  angle  between  seismic  mass 
and  case  is  measured  by  a  pickoff  and  integrated  to  give  angular  rate. 

Thus  angular  rate  and  acceleration  information  is  available  in  principle. 

A  washout  circuit  is  used  to  offset  long-term  null  and  biases. 

The  typical  unit  weighs  10  ounces  and  has  a  30,000  hr  MTBF.  This  high 
reliability  is  due  to  the  fact  that  there  are  no  spin  motors  or  wheel 
hearings  to  wear  out.  Power  consumption  is  less  than  one  watt,  and  it  has 
been  qualified  to  -40  deg  to  200  deg  P  temperature  and  a  500  g/11  msec 
shock  environment.  Warm-up  time  is  0.05  sec  so  that  it  does  not  have  to  be 
started  until  the  ejection  procedure  begins.  It  is  a 

s  ingle-degree-of-freedom  device  and,  with  its  self-test  features,  is  an 
attractive  candidate  for  rate  sensing.  Further,  it  can  be  multitasked  to 
provide  both  angtilar  acceleration  and  rate,  as  either  main  or  redundant 
inputs. 

One  specific  unit  is  the  Systran  Donner  accelerometer.  This  is  a 
fluidic  device  which  requires  less  than  1  watt  of  power,  and  weighs  less 
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than  10  oz.  It  has  been  used  on  military  and  commercial  aircraft  as  a  rate 
sensor.  Its  size  is  rather  large,  but  could  be  offset  by  a  redesign  to 
provide  both  acceleration  and  rate.  Its  output  range  is  +/-  1150 
deg/sec**2  for  acceleration  and  +/-  20  deg/sec  for  rate.  The  rate  limits 
are  clearly  unacceptable,  but  could  presumably  be  Improved.  It  can 
withstand  100  g  shock,  has  no  mechanical  moving  parts,  is  very  linear  In 
response,  and  easily  interfaced  with  electronics.  Two  other  appealing 
features  are  fast  startup  and  low  cost,  and  it  also  has  self-test 
capability.  The  major  drawback  in  addition  to  the  rate  range  is  the  low 
temperature  operating  limit,  now  at  -22  deg  (F). 

It  seems  that  a  better  unit  is  the  Schaevitz  ASM.  This  device  is  a 
servo  accelerometer,  and  it  has  very  appealing  size  (1.8  cii.  in.),  weight 
(2  oz.)  and  operating  temperature  (-67  to  203  deg  (F))  specs.  Each  unit  is 
single  axis,  costs  about  $800,  and  requires  15  volts  DC,  and  10  raa. 

Results.  Tables  5.12  and  5.13  present  the  results  of  our  angular 
accelerometer  trade  analysis.  Again,  the  recommendation  is  to  consider  the 
top  few  scorers,  since  further  development  for  specific  seat  use,  not 
weighted  heavily  here,  could  produce  a  better  device.  In  fact,  all  four 
devices  here  should  be  retained  in  consideration. 

5. 5. 1.4  Acceleration  Sensors.  Conventional  low  cost  acceleration 
sensing  technology  is  accurate  to  within  2  percent  or  so,  which  is  adequate 
for  ejection  seat  control.  There  are  several  units  in  production  today 
which  appear  to  offer  all  of  the  key  specs  needed  for  ejection  seat 
applications.  Size,  weight,  performance,  power  requirements,  and 
reliability  of  several  candidates  would  be  within  seat  requirements. 

Sunstrand  Corporation  manufactures  a  flight  control  grade 
accelerometer.  Model  qA900,  which  has  been  used  for  Navy  tactical  missiles 
such  as  the  SMI,  SM2  and  Harpoon.  The  instrument  meets  M1L-883B,  weighs  65 
grams  (2.3  oz.),  occupies  less  than  one  cubic  inch  of  space  and  costs  about 
$1000.  Its  operating  temperature  range  is  also  acceptable.  One  unit  is 
needed  for  each  axis.  The  environmental  specifications  include: 

vibration  ;  30  g/20-l800  Hz 

1 2  g  rms/ random 
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shock 


;  250  g/5  msec 


The  instrument  measures  50  g  full  scale  and  is  quite  accurate. 

Another  competitive  instrument  is  a  pendulous  A/C  excited 
accelerometer  manufactured  by  Timex.  Volume  is  less  than  one  cubic  inch, 
weight  less  than  one  pound  and  the  price  is  about  $500.  Measurements  up  to 
40  g  can  be  made  and  shock  up  to  400  g  can  be  tolerated.  Error 
characteristics  are; 

temperature  effect  ;  0.04%/  C 

total  error  ;  2%  at  full  scale 

Northrop  Precision  Products  Division  manufactures  the  APS-5 
accelerometer,  which  weighs  about  4  ounces,  occupies  about  two  cubic 
Inches,  and  costs  about  $700.  Measurements  to  +/-20  g’s  can  be  made,  and 
the  device  meets  the  following  specifications: 


vibration 

shock 

angular  rate 


10  rms/20-2000  Hz 

100  g/ll  msec,  half  sine 

600  /sec 


The  error  characteristics  are: 

offset  ;  1  ft/sec 

scale  factor  ;  2% 

Columbia  Research  Labs  makes  a  servo  accelerometer,  the  RA-120.  In 
this  unit  the  seismic  mass  is  not  mechanically  constrained,  so  that  there 
is  minimal  hysteresis  and  nonlinearity.  The  devices  are  very  small  in  size 
and  weight,  and  can  sense  over  a  range  of  0  to  50  g's. 

A  final  unit  which  is  highly  attractive  is  the  Entran  EGA3  series.  A 
iriaxial  system  can  be  placed  in  a  1  cubic  inch  volume,  and  the  output 
signal(s)  are  high  enough  to  not  require  amplification.  It  weighs  17 
grams,  requires  15  volts  power,  and  has  fine  thermal  properties  (although 
its  low  temperature  limit,  -40  deg  (F),  could  be  a  bit  improved). 
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Results.  Tables  5.14  and  5.15  present  the  results  of  our 
accelerometer  trade  analysis.  A  highly  appealing  device  for  seat  use,  not 
Included  here  due  to  late  arrival  of  data.  Is  made  by  Insouth  Microsystems. 
The  unit  is  measured  in  milliinches,  and  is  very  rugged.  It  could  well 
outscore  the  devices  presented  in  Tables  5.14  and  5.15.  Of  the  latter,  the 
Entran  performs  best  of  several  good  designs. 

I 

I 

5. 5. 1.5  Combined  Angular  Rate  and  Acceleration  Sensors;  Strapdown 
Systems.  Strapdown  systems  differ  from  the  more  conventional  gimballed 
:  systems  in  that  the  sensors  are  mounted  directly  on  the  ejection  seat  and 

the  transformation  from  the  sensor  to  inertial  reference  frame  is  computed 
rather  than  mechanized.  The  potential  advantages  of  strapdown  systems  over 
stabilized  platforms  include  Lower  cost,  reduced  weight  and  power 
consumption,  increased  reliability,  ease  of  maintenance  and  manufacture, 
and  redundant  design.  An  on-seat  microprocessor  can  perform  computations. 

Strapdown  technology  has  been  operational  for  over  fifteen  years  and 
has  achieved  a  mature  status.  Originally  held  back  by  computational 
requirements,  there  is  now  a  widespread  increase  in  their  use,  due  both  to 
major  advances  in  computer  technology  and  sensor  designs  with  increased 
dynamic  range  and  vibration  accommodation.  Lower  costs  are  related  to  the 
fact  that  strapdown  systems  can  perform  well  with  lower  cost  production 
grade  gyros.  However,  startup  time  is  a  major  problem  with  most 
off-the-shelf  strapdown  units.  This  would  offset  any  potential 
packaging/ integral  Ion  advantage. 

Strapdown  navigators  generally  include  both  gyros  and  accelerometers 
and  associated  special-purpose  computer  circuitry  for  performing  the 
required  sophisticated  data  processing.  This  self-contained,  or  modular, 
approach  allows  redundancy  for  increased  reliability  to  be  implemented  at 
the  sensor  and  component  level,  rather  than  the  system  level. 


Strapdown  gyros  are  usually  of  the  rate  integrating  type  and  generate 
incremental  angle  pulses  over  fixed  sampling  intervals,  which  can  be 
converted  directly  into  angular  rates.  Spinning  mass  gyros  are  "caged" 
electronically  to  the  gyro  case  by  servo  commands,  called  rebalance 


torques.  Laser  gyros  are  also  available  which  do  not  require  caging. 
However,  current  technology  laser  devices  in  general  are  not  appealing  for 
ejection  seat  application,  due  to  power,  cost,  and  reliability 
considerations . 

The  transformation  from  sensor  to  inertial  frame  is  done  using  a  set 
of  attitude  parameters  such  as  Euler  symmetric  parameters,  Hamilton's 
quaternions  and  Cayiey-Klein  parameters;  a  variety  of  other  sets  have  been 
proposed,  each  capable  of  avoiding  the  "gimbal  lock"  singularity.  The 
parameters  are  found  by  solving  a  set  of  kinematic  equations.  These 
e(|uatIons  must  he  solved  at  a  very  high  rate  to  minimize  computational 
error.  An  alternate  approach,  the  electrostatic  gyro,  obviates  this 
problem  entirely  by  measuring  the  paramters  directly. 

Present-day  systems  are  easily  capable  of  accuracies  exceeding  0.1 
degrees  in  attitude  and  0.02  ft/sec**2  in  acceleration  in  a  severe 
environment  such  as  seat  ejection,  as  long  as  the  sensors  are  calibrated 
periodically  (several  times  per  hour). 

Quite  often,  the  capability  of  such  systems  is  excessive,  especially 
for  the  cost  involved.  Strapdown  navigators  made  by  Litton  Systems  and 
Honeywell,  for  example,  cost  $50,000  or  more,  totally  unrealistic  for 
ej or Lion  seat  needs. 

Conventional  Systems.  Conventional  systems  are  often  referred  to  as 
multisensors.  An  example  of  such  a  sensor  package  is  the  Rockwell  (Collins 
Avionics  Division)  Multisensor  which  is  a  small,  low  cost  device  developed 
for  tactical  missile  applications.  Each  sensor  yields  two  rates  and 
acceleration  normal  to  spin  axis.  Two  such  sensors  yield  the  required 
three  axes  of  rate  and  acceleration  while  providing  redundancy  along  a 
preselected,  most  sensitive,  direction. 

This  system  achieves  somewhat  higher  accuracy  than  conventional 
systems.  For  example,  rate  measurements  are  accurate  to  about  0.03%  of 
full  scale,  while  the  acceleration  offset  error  is  about  0.04%  of  full 


The  unit  is  still  under  development,  but  prototype  units  and  test  data 
are  available.  Presently,  a  development  effort  is  underway  to  design  a 
sensor  that  is  compatible  with  tactical  missiles,  for  the  U.S.  Army 
Missile  Command. 

5.5.I.b  Pressure  and  Air  Data  Sensors.  Direct  measurement  of 
pressure  is  a  highly  desirable  ability  for  effective  sequencing  and  control 
of  the  ejection  seat.  Some  systems  compute  pressure  altitude  as  well  as 
static  and  dynamic  pressure. 

A  pressure  transducer  which  seems  to  satisfy  most  seat  requirements  is 
the  Garrett  quartz  pressure  sensor,  P/N  2118132-1.  This  unit  is  light  (5.4 
oz.),  small,  does  not  require  periodic  maintenance,  has  an  acceptable 
temperature  operating  range,  dynamic  range,  and  measurement  range.  The 
warmup  time  is  200  msec,  which  may  be  adequate,  but  could  be  improved.  A 
larger  problem  which  may  be  able  to  be  designed  out  is  the  low  acceleration 
tolerance,  10  g's  along  any  axis. 

Other  manufacturers  make  pressure  transducers  of  comparable 
performance  to  the  Garrett,  but  the  latter  is  at  least  as  good  in  all  specs 
important  to  seat  use.  Entran,  Sensym,  Rosemount  and  Foxboro/ICT  are  some 
of  many  suppliers  of  usable  units. 

In  the  area  of  wind  direction  sensing,  Rosemount  makes  a  flight  test 
boom  for  direct  measurement  of  angles  of  attack  and  sideslip,  but  this 
device  is  too  bulky  and  limited  in  operation  range  to  be  considered. 
However,  a  technology  effort  aimed  at  the  ejection  seat  application  may  pay 
off. 

Another  interesting  device  developed  at  the  US  Air  Force  Academy  for 
NASA/ Ames  is  the  seven-hole  probe.  This  conical  device  can  measure  angles 
of  attack  and  sideslip,  as  well  as  airspeed.  Only  laboratory  models  have 
been  built,  however,  and  this  type  of  technology  may  be  lagging  too  much 
for  ejection  seat  needs. 

Finally,  Garrett  is  committed  to  develop  a  sensor  for  seat  use.  It  is 
a  device  about  0.5  inches  in  diameter,  very  light,  and  less  than  a  foot 
long.  It  can  measure  airspeed  magnitude  and  direction. 


Results.  Tables  5.16  and  5.17  present  the  results  of  our  trade  study 
for  pressure  sensors,  and  Tables  5.18  and  5.19  present  results  for  the  air 
data  sensors. 

There  are  several  small,  rugged  and  reliable  pressure  sensors  to 
choose  from.  Three  are  clustered  at  the  top,  by  our  ranking  scheme,  but 
others  should  be  considered  should  factors  weighted  less  here,  such  as 
eost,  become  important  later. 

The  air  lata  sc'iisors  liave  not  yet  been  adapted  for  seat  use,  hut  all 
t)Mer  new  technology  advances  over  current  seat  sensors,  particularly  in 
the  ability  to  measure  wind  direction.  Therefore,  current  seat  air  data 
sensors  are  not  included. 

5.5.2  Thrust  Actuation  Hardware.  A  somewhat  different  situation  is 
encountered  in  performing  a  trade  analysis  of  propulsion  hardware  for 
active  control  of  ejection  seats,  than  is  the  case  in  analyzing  the  sensor 
hardware-  lor  this  control  system.  In  the  latter  case,  most  of  the 
Cfjrnpononts  are  nearly  ready  for  use  "off  the  shelf".  Concerning  propulsion 
fiysiems,  there  is  -  as  with  the  sensors  -  a  wide  range  of  devices  and  a 
technology  level  which  offer  promise  of  meeting  the  major  goals  of  an 
act  ive  thnist,  control  system.  However,  there  is  as  yet  no  complete 
propulsion  sy-Uem  ready  to  he  attached  to  a  seat  and  perform  to  the 
requirements  <)f  the  controller  being  designed  in  this  project. 

Thus,  we  are  doing  much  "projection  analysis",  assuming  that 
sufticient  development  effort  will  be  undertaken  which  will  lead  to  a 
complete,  integrated  system.  This  means  that  the  weighting  factors  for 
propulsion  systems  differ  from  their  sensor  counterparts.  Also,  we  have 
kept  the  I' ip, lire  of  merit  scorinp,  range  closer,  from  0.7  to  O.d,  to  reflect 
the  notion  that  a  concept  which  now  scores  relative  poorly  may  outperform 
the  others  when  full  development  for  the  seat  application  is  initiated. 
Another  aspect  here  is  that  the  weighting  is  selected  not  only  for  the 
obvious  system  requirements,  such  as  weight,  cockpit  size,  etc.,  but  for 
our  s()ecific  control  system  design.  This  design,  if  fully  implemented, 
will  rcqu.'r'-,  lor  <-\.iinp|i-,  .il  li-asl  llirec  iiozzli-  systems.  More  conlrul 
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system  requirements  are  discussed  below  and  throughout  this  report.  For 
now,  we  recommend  that  the  two  or  three  concepts  which  score  well  in  this 
analysis  receive  detailed  attention  in  future  design  and  analysis  work,  hut 
that  the  other  concepts  also  receive  consideration. 

After  much  preliminary  review,  which  Included  meetings  and  discussions 
with  key  manufacturers,  we  have  selected  seven  generic  concepts  for 
analysis.  The  results  are  presented  in  Tables  5.20  -  5.21,  which  represent 
three  levels,  top  to  bottom  respectively.  The  companies  which  supplied 
most  of  the  data  include:  Garrett  Corp.,  Stecel  Aero  Engineering,  Atlantic 
Research  Corp.,  Martin/Marietta,  TRW,  and  Morton  Thiokol  Tnc.  Because  much 
of  their  data  is  proprietary,  wo  only  reflect  It  Indirectly  in  tlie  decision 
matrices  of  Tables  5.20  -  5.21. 

Blueline  drawings  for  the  MMOA  and  Stencel  concepts  are  presented  in 
Appendix  B.  We  now  discuss  briefly  these  concepts,  and  later  on.  Interpret 
the  results. 

The  three  major  propulsion  subsystems  of  interest  to  the  control 
engineer  are  the  energy  source,  and  the  means  of  vectoring  and  modulating 
the  thrust.  Key  features  of  the  propellant  (energy  source)  Include 
packaging,  storage  ability,  reliability,  high  specific  impulse  density,  and 
non-volatility.  Almost  certainly,  solid  fuels  will  be  used  because  of 
their  past  performance  in  meeting  the  particular  seat  requirements.  A  very 
appealing  fuel  is  a  gel-like  substance  developed  by  TRW.  It  has  very  high 
volume  efficiency,  in  addition  to  fine  storage  capability  and  the  usual 
attributes  of  solids.  However,  the  thrust  modulation  requirement  and  the 
fact  that  solids  can  be  difficult  to  turn  off  may  result  in  examination  of 
liquid  systems.  (Fluidic  systems  are  very  prominent  as  actuation  devices.) 

Thrust  vectoring  Is  achieved  by  reaction  Jet  control  or  thrust  vector 
control,  the  two  major  generic  classes.  The  concepts  presented  here  are  a 
mix  of  these  classes.  Actuation  systems  should  be  of  the  pyrotechnic  warm 
gas  or  cold  (stored)  gas  variety,  as  electrical  or  hydraulic  systems  are 
not  practical  for  ejection  seats.  Many  actuation  concepts  were  reviewed 
during  this  project.  Fluidic  TVC,  movable  nozxle  TVC  (e.g.,  trapped  ball). 


and  TVC  via  mechanical  deflection  were  the  key  concepts  considered. 
Mechanical  deflection  is  achieved  by  inserting  tabs  into  the  exhaust 
stream.  There  is  typically  a  large  loss  of  axial  thrust  when  the  vanes  are 
at  maximum  deflection.  Also,  the  net  angle  of  deflection  generally  is 
smaller.  The  fluidic  systems  offer  high  reliability,  fewer  moving  parts, 
and  generally  lower  weight.  As  such,  they  are  quite  attractive.  Garrett 
is  a  leader  in  this  technolqgy. 

Modulation  of  thrust  is  also  critical  for  our  control  design,  in  order 
to  achieve  acceptable  performance  over  the  full  escape  envelope.  Several 
concepts  were  examined,  including  pulse  motors,  overboard  bleed,  variable 
area  nozzles,  multiple  motors,  and  manifolded  systems. 

The  control  system  requirements  dictate  a  minimum  of  three 
"independent"  nozzle/actuation  systems.  By  independent  is  meant  that 
thrust  magnitude  and  direction  settings  of  any  one  nozzle  are  not  dependent 
on  tliose  of  .my  other  nozzle  or  nozzles,  but  only  on  their  own  mechanical 
limitations.  More  strictly,  two  fully  independent  and  one  partially 
independent  nozzle  are  sufficient  to  perform  the  combined  attitude  and 
trajectory  control  tasks.  In  Section  7  of  this  report  we  discuss  the 
controllability  aspects  in  more  detail. 

Our  simulations  to  date  indicate  a  requirement  for  about  4000  ft-lb 
torijue  capability,  and  about  9500  lb  total  force.  The  torque  requirement 
is  directly  related  to  the  aerodynamic  moments  which  can  be  generated  at 
the  high  Q  (dynamic  pressure)  limits  of  the  escape  envelope.  Similarly, 
the  force  requirement  is  derived  from  the  need  to  offset  the  aerodynamic 
decelerations  at  high  Q,  so  that  the  pilot's  acceleration  radical  is 
1 1)  I  !•  r.ib  I  ,  and  by  ri'ipi  I  rciiuMit  s  rt>l.'itln>^  to  I  r.i )  ec  L  or  y  control  -  e.g., 
a  VO  I  il  .inci'  ol  parts  of  the  aircraft  during  injection,  and  achieving 
sufficient  altitude  rate  for  safe  chute  deployment. 

The  high  Q  escape  condition  and  the  various  adverse  attitude 
conditions  force  the  propulsion  system  to  react  very  rapidly  to  changes  in 
the  dynamic  environment.  Our  studies  done  to  date  indicate  that  thrust 
vectoring  rates  <if  Lht;  order  of  600  to  800  deg/sec  are  required,  and  that 
the  sustainer  rocket  glmhal  cone  angles  should  he  close  to  40  degrees. 
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One  model  which  has  been  analyzed  extensively  consists  of  three 
nozzles  (motors).  One  is  located  in  the  x— z  plane,  and  has  more  total 
impulse  than  the  other  two.  This  may  be  considered  as  the  sustainer  motor. 
The  other  two  are  "mirror  images"  with  respect  to  the  x-z  plane,  and  have 
less  total  impulse  than  the  sustainer.  These  "verniers"  are  like  RCS 
rockets,  while  the  sustainer  will  likely  have  a  gimballed  nozzle.  See 
Section  3. 2. 2. 3. 

An  extremely  attractive  candidate  for  the  vernier  actuation  system  is 
the  Martin  Marietta  gated  fixed  pintle  poppet  valve.  It  has  excellent 
response  characterist ics ,  and  seems  capable  of  achieving  the  high  slew 
rates.  This  concept  has  been  simulated  and  performs  very  well  using  the 
control  law  described  in  Chapter  4.  See  also  Section  3. 2. 2. 4. 

Garrett  Corp.  also  has  attractive  actuation  systems,  which  could  also 
be  applied  to  the  sustainer  nozzle.  Their  systems  have  bandwidths  to  100 
Hz,  and  are  offered  as  low  cost,  reliable,  fluidic  systems.  The  major 
question  with  regards  to  seat  applications  is  can  these  systems  move  as 
quickly  the  thrust  levels  required  by  the  seat.  Garrett  has  developed 
fluidic  reaction  jet  control  systems  for  rocket  nozzles,  and  these  seem  to 
be  possible  competitors  to  the  Martin  Marietta  valve.  They  are 
lightweight,  low  cost,  simple  mechanically,  very  reliable,  EMI  insensitive, 
good  dynamic  response  (not  quite  as  good  as  Martin  Marietta) ,  and  possess 
high  packaging  efficiency. 

Summarizing  the  Tables  5.20  -  5.22  design  concepts,  the  first  two  were 
studied  by  ARC  in  their  selectable  thrust  project;  the  last  two  similarly 
were  studied  by  MTI  in  their  selectable  thrust  project.  We  state  here  that 
our  weighting  and  performance  scoring  is  different,  because  we  are  relating 
these  concepts  to  our  particular  design.  The  Martin/Marietta  High  Force 
Gain  Valve  actuation  system  is  listed,  with  the  assumption  that  the 
extensive  development  work  required,  not  weighted  heavily  here,  will  be 
done. 

Finally,  the  fourth  and  fifth  concepts  in  the  tables  are  from  Garrett. 
The  pneumatic  TVC  actuation  concept  has  proven  performance  in  other 
applicat Ions. 


Results.  The  rankings  in  the  tables  must  be  considered  in  light  of 
the  discussion  above.  There  are  built  in  assumptions  and  expectations 
relating  to  further  development,  which  must  occur  if  the  concepts  are  to  be 
realized.  Nonetheless,  our  best  available  information  to  date  leads  to  a 
clustering  of  concepts  which  coincides  with  what  are  felt  now  to  be  very 
attractive  concepts.  An  Integrated  design  effort  for  thrust  modulation, 
actuation  and  propellant  will  likely  include  major  subsystems  from  the 
Martin/Marietta  actuation  scheme  or  the  Garrett  fluidic  or  pneumatic 
concepts.  It  is  recognized  that  other  manufacturers  may  actually  develop 
better  systems  than  the  ones  presented  here,  but  these  are  considered 
generic  concepts  at  this  time. 

5.5.3  Summary  and  Recommendations.  Many  systems  can  comfortably  meet 
the  ejection  seat  control  system  requirements.  An  example  of  this  is  the 
accelerometer.  Others,  such  as  rocket  actuators,  must  be  carefully 
compared  and  evaluated,  because  the  requirements  are  at  the  limits  of  the 
technology.  All  of  the  systems  are  subject  to  the  real  and  severe 
constraints  of  size,  storage  ability,  weight,  reliability,  low  cost,  and 
good  performance  in  all  extremes  of  the  environment. 

Based  on  manufacturer's  specifications,  the  recommended  control  system 
hardware  components  are,  in  order: 

1. )  Attitude  sensors:  radar  altimeters 

mlcrad  sensors 

fluidic  integrating  rate  sensors 
(Garrett) 

2. )  Attitude  Rate  Sensors:  Garrett  Alrgyro 

Honeywell  GG2500 
Northrop  GR-G5  rate  gyro 
Singer/Kearfott  CLAR 

3. )  Angular  accelerometers:  Schaevitz  ASM 

Systran  Donner 

4. )  Linear  accelerometers:  Entran  EGA3 

Columbia  Research  Lab  SA-120 


5.)  Pressure/atmospheric  sensors:  Microswitch  230  PC 


Schaevltz  P710 


6«)  Air  Data  Sensors:  Garrett 

7.)  Thrust  actuation  systems:  Martin  Marietta 

Garrett 

(  recommend  using  results  of  ARC 
and  Thiokol  selectable  thrust 
design,  analysis  projects  ) 
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